deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-32078
Published: 2021-06-17
Description: An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f; https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f; https://kirtikumarar.com/CVE-2021-32078.txt
CVE: CVE-2013-20002
Published: 2021-06-17
Description: Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://en.0day.today/exploit/22090; https://packetstormsecurity.com/files/124149/WordPress-Elemin-Shell-Upload.html; https://themify.me/blog/updated-themify-framework-to-fix-the-vulnerability
CVE: CVE-2020-19202
Published: 2021-06-17
Description: An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFire 2.21 (x86_64) - Core Update 130. It allows an authenticated WebGUI user with privileges to execute Stored Cross-site Scripting in the Captive Portal page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.ipfire.org/post/ipfire-2-23-core-update-132-released; https://gist.github.com/dharmeshbaskaran/2825ee8ae48b9065193c07a92b3a712c; https://blog.ipfire.org/post/ipfire-2-23-core-update-132-released
CVE: CVE-2020-35373
Published: 2021-06-17
Description: In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://loganclaw.com/2020/12/07/fiyo-cms-reflected-xss/; http://loganclaw.com/2020/12/07/fiyo-cms-reflected-xss/
CVE: CVE-2021-29706
Published: 2021-06-17
Description: IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of service. IBM X-Force ID: 200663.
CVSS Score: 7.1 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200663; https://www.ibm.com/support/pages/node/6464369; https://exchange.xforce.ibmcloud.com/vulnerabilities/200663
CVE: CVE-2021-23396
Published: 2021-06-17
Description: All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-LUTILS-1311023; https://snyk.io/vuln/SNYK-JS-LUTILS-1311023
CVE: CVE-2021-32681
Published: 2021-06-17
Description: Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wagtail/wagtail/releases/tag/v2.11.8; https://github.com/wagtail/wagtail/releases/tag/v2.12.5; https://github.com/wagtail/wagtail/releases/tag/v2.13.2
CVE: CVE-2020-36388
Published: 2021-06-17
Description: In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/; https://civicrm.org/advisory/civi-sa-2020-03; https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/
CVE: CVE-2020-36389
Published: 2021-06-17
Description: In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/; https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-form; https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/
CVE: CVE-2021-32575
Published: 2021-06-17
Description: HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
CVSS Score: 6.5 (MEDIUM)
References: https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296; https://www.hashicorp.com/blog/category/nomad; https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296
CVE: CVE-2021-33557
Published: 2021-06-17
Description: An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mantisbt.org/blog/archives/mantisbt/699; https://mantisbt.org/bugs/view.php?id=28552; https://mantisbt.org/blog/archives/mantisbt/699
CVE: CVE-2021-32695
Published: 2021-06-17
Description: Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose the malicious app. The shared preferences contain some limited private data such as push tokens and the account name. The vulnerability is patched in version 3.16.1.
CVSS Score: 3.9 (LOW)
CWE: CWE-200
References: https://github.com/nextcloud/android/pull/8433; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-25m9-cf6c-qf2c; https://hackerone.com/reports/1142918
CVE: CVE-2021-32424
Published: 2021-06-17
Description: In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Galapag0s/Trendnet_TW100-S4W1CA/blob/main/writeup_CSRF.txt; https://github.com/Galapag0s/Trendnet_TW100-S4W1CA/blob/main/writeup_CSRF.txt
CVE: CVE-2021-32426
Published: 2021-06-17
Description: In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Galapag0s/Trendnet_TW100-S4W1CA/blob/main/writeup_XSS.txt; https://github.com/Galapag0s/Trendnet_TW100-S4W1CA/blob/main/writeup_XSS.txt
CVE: CVE-2021-32694
Published: 2021-06-17
Description: Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-248
References: https://github.com/nextcloud/android/pull/7919; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vc; https://hackerone.com/reports/859136
CVE: CVE-2021-32693
Published: 2021-06-17
Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129; https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728; https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq
CVE: CVE-2021-34553
Published: 2021-06-18
Description: Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]371; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]371
CVE: CVE-2021-34808
Published: 2021-06-18
Description: Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://www.synology.com/security/advisory/Synology_SA_21_10; https://www.synology.com/security/advisory/Synology_SA_21_10
CVE: CVE-2021-34809
Published: 2021-06-18
Description: Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77
References: https://www.synology.com/security/advisory/Synology_SA_21_11; https://www.synology.com/security/advisory/Synology_SA_21_11
CVE: CVE-2021-34810
Published: 2021-06-18
Description: Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269
References: https://www.synology.com/security/advisory/Synology_SA_21_11; https://www.synology.com/security/advisory/Synology_SA_21_11
CVE: CVE-2021-34811
Published: 2021-06-18
Description: Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://www.synology.com/security/advisory/Synology_SA_21_11; https://www.synology.com/security/advisory/Synology_SA_21_11
CVE: CVE-2021-34812
Published: 2021-06-18
Description: Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-798
References: https://www.synology.com/security/advisory/Synology_SA_21_12; https://www.synology.com/security/advisory/Synology_SA_21_12
CVE: CVE-2021-21669
Published: 2021-06-18
Description: Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2021/06/18/1; https://www.jenkins.io/security/advisory/2021-06-18/#SECURITY-2330; http://www.openwall.com/lists/oss-security/2021/06/18/1
CVE: CVE-2021-32536
Published: 2021-06-18
Description: The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-4811-4a160-1.html; https://www.twcert.org.tw/tw/cp-132-4811-4a160-1.html
CVE: CVE-2021-33347
Published: 2021-06-18
Description: An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the background by means of weak password, the storage XSS vulnerability can occur.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/JPressProjects/jpress/issues/152; https://github.com/JPressProjects/jpress/issues/152#issuecomment-850119847; https://github.com/JPressProjects/jpress/issues/152
CVE: CVE-2021-33576
Published: 2021-06-18
Description: An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md; https://www.cleo.com/cleo-lexicom; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md
CVE: CVE-2021-33577
Published: 2021-06-18
Description: An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md; https://www.cleo.com/cleo-lexicom; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md
CVE: CVE-2021-26834
Published: 2021-06-18
Description: A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immediately on markdown view mode.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alagrede/znote-app/issues/5; https://www.electronjs.org/apps/znote; https://github.com/alagrede/znote-app/issues/5
CVE: CVE-2021-26835
Published: 2021-06-18
Description: No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Zettlr/Zettlr/issues/1716; https://github.com/Zettlr/Zettlr/releases/tag/v1.8.9; https://github.com/Zettlr/Zettlr/issues/1716
CVE: CVE-2021-34815
Published: 2021-06-18
Description: CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.checksec.com/canopy.html; https://www.compass-security.com/en/research/advisories; https://www.compass-security.com/fileadmin/Research/Advisories/2021-10_CSNC-2021-015-Checksec_Canopy_HTLM_Injection.txt
CVE: CVE-2005-0394
Published: 2021-06-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2007-3733
Published: 2021-06-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-21997
Published: 2021-06-18
Description: VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest operating system, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest operating system.
CVSS Score: 5.5 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2021-0011.html; https://www.vmware.com/security/advisories/VMSA-2021-0011.html
CVE: CVE-2018-14639
Published: 2021-06-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-23845
Published: 2021-06-18
Description: This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from version 3.08 on, which was released on June 2019.
CVSS Score: 8.0 (HIGH)
CWE: CWE-284
References: https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html
CVE: CVE-2021-23846
Published: 2021-06-18
Description: When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. This will be fixed starting from Firmware version 3.11.5, which will be released on the 30th of June, 2021.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319, CWE-319
References: https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-196933-bt.html
CVE: CVE-2021-32954
Published: 2021-06-18
Description: Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-168-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-168-03
CVE: CVE-2021-32956
Published: 2021-06-18
Description: Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could result in redirecting a user to a malicious webpage.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-168-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-168-03
CVE: CVE-2005-2795
Published: 2021-06-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-18442
Published: 2021-06-18
Description: Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
CVSS Score: 3.3 (LOW)
CWE: CWE-835
References: https://github.com/gdraheim/zziplib/issues/68; https://lists.debian.org/debian-lts-announce/2021/12/msg00021.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCFYD46OY4VAGJ4UX7IFOH5SHD4UW4ZA/
CVE: CVE-2021-3604
Published: 2021-06-18
Description: Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://titaniumaics.blogspot.com/2021/06/vulnerabilidad-zero-day-en-primion.html; https://www.incibe-cert.es/en/early-warning/ics-advisories/primion-digitek-secure-8-sql-injection-vulnerability; http://titaniumaics.blogspot.com/2021/06/vulnerabilidad-zero-day-en-primion.html
CVE: CVE-2021-33818
Published: 2021-06-18
Description: An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33818.md; https://github.com/shekyan/slowhttptest; https://store.ui.com/collections/unifi-protect-cameras/products/unifi-video-g3-flex-camera
CVE: CVE-2021-33820
Published: 2021-06-18
Description: An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33820.md; https://linuxhint.com/hping3/; https://store.ui.com/collections/unifi-protect-cameras/products/unifi-video-g3-flex-camera
CVE: CVE-2021-33822
Published: 2021-06-18
Description: An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33822.md; https://github.com/shekyan/slowhttptest; https://www.sing4g.com/product-page/4gee-router-hh70vb-4g-300mbps-2lan-32wifi
CVE: CVE-2021-21282
Published: 2021-06-18
Description: Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In versions prior to 4.5, buffer overflow can be triggered by an input packet when using either of Contiki-NG's two RPL implementations in source-routing mode. The problem has been patched in Contiki-NG 4.5. Users can apply the patch for this vulnerability out-of-band as a workaround.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/contiki-ng/contiki-ng/pull/1183; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6xf2-77gf-fgjx; https://github.com/contiki-ng/contiki-ng/pull/1183
CVE: CVE-2021-32696
Published: 2021-06-18
Description: The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-241, CWE-843
References: https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2faca; https://github.com/ericnorris/striptags/releases/tag/v3.2.0; https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49r
CVE: CVE-2021-33823
Published: 2021-06-18
Description: An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33823.md; https://www.moxa.com/en/products/industrial-edge-connectivity/protocol-gateways/modbus-tcp-gateways/mgate-mb3180-mb3280-mb3480-series; https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33823.md