deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-40928
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d8ahazard/FlexTV; https://github.com/d8ahazard/FlexTV/issues/37; https://github.com/d8ahazard/FlexTV
CVE: CVE-2021-40968
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb; https://github.com/spotweb/spotweb/issues/711; https://github.com/spotweb/spotweb
CVE: CVE-2021-40969
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb; https://github.com/spotweb/spotweb/issues/711; https://github.com/spotweb/spotweb
CVE: CVE-2021-40970
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb; https://github.com/spotweb/spotweb/issues/711; https://github.com/spotweb/spotweb
CVE: CVE-2021-40971
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb; https://github.com/spotweb/spotweb/issues/711; https://github.com/spotweb/spotweb
CVE: CVE-2021-40972
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb; https://github.com/spotweb/spotweb/issues/711; https://github.com/spotweb/spotweb
CVE: CVE-2021-40973
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb; https://github.com/spotweb/spotweb/issues/711; https://github.com/spotweb/spotweb
CVE: CVE-2021-40975
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Bootstrap 3.3.7) allows remote attackers to inject arbitrary web script or HTML via the search_title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/blob/c546a716ba56e8e33b3a5def1c18a6d89c3608f5/application/modules/admin/views/ecommerce/products.php#L37; https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/blob/c546a716ba56e8e33b3a5def1c18a6d89c3608f5/application/modules/admin/views/ecommerce/products.php#L37
CVE: CVE-2021-41461
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/concrete5/concrete5-legacy; https://github.com/concrete5/concrete5-legacy/issues/2006; https://github.com/concrete5/concrete5-legacy
CVE: CVE-2021-41462
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/concrete5/concrete5-legacy; https://github.com/concrete5/concrete5-legacy/issues/2006; https://github.com/concrete5/concrete5-legacy
CVE: CVE-2021-41463
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/concrete5/concrete5-legacy; https://github.com/concrete5/concrete5-legacy/issues/2006; https://github.com/concrete5/concrete5-legacy
CVE: CVE-2021-41464
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/concrete5/concrete5-legacy; https://github.com/concrete5/concrete5-legacy/issues/2006; https://github.com/concrete5/concrete5-legacy
CVE: CVE-2021-41465
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/concrete5/concrete5-legacy; https://github.com/concrete5/concrete5-legacy/issues/2006; https://github.com/concrete5/concrete5-legacy
CVE: CVE-2021-41467
Published: 2021-10-01
Description: Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hjue/JustWriting/; https://github.com/hjue/JustWriting/issues/106; https://github.com/hjue/JustWriting/
CVE: CVE-2021-38097
Published: 2021-10-01
Description: Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-026; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-026
CVE: CVE-2020-21012
Published: 2021-10-01
Description: Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hitIer/web_test/tree/master/hotel; https://github.com/hitIer/web_test/tree/master/hotel
CVE: CVE-2020-21013
Published: 2021-10-01
Description: emlog v6.0.0 contains a SQL injection via /admin/comment.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/emlog/emlog/issues/52; https://github.com/emlog/emlog/issues/52
CVE: CVE-2020-21014
Published: 2021-10-01
Description: emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/emlog/emlog/issues/53; https://github.com/emlog/emlog/issues/53
CVE: CVE-2021-38096
Published: 2021-10-01
Description: Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-025; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-025
CVE: CVE-2021-38099
Published: 2021-10-01
Description: CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-030; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-030
CVE: CVE-2021-38103
Published: 2021-10-01
Description: IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-031; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-031
CVE: CVE-2021-38104
Published: 2021-10-01
Description: IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-032; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-032
CVE: CVE-2021-41845
Published: 2021-10-01
Description: A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. The only affected versions are 10.9.000032 through 11.0.000006.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://docs.thycotic.com/bulletins/current/2021/11.0.000007.md; https://docs.thycotic.com/ss/11.0.0/release-notes/ss-rn-11-0-000007.md; https://docs.thycotic.com/bulletins/current/2021/11.0.000007.md
CVE: CVE-2020-21228
Published: 2021-10-01
Description: JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jizhicms.com; https://github.com/Cherry-toto/jizhicms; https://github.com/Cherry-toto/jizhicms/issues/16
CVE: CVE-2021-36298
Published: 2021-10-01
Description: Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker to take complete control of InsightIQ to affect services provided by SSH; so Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/000191604; https://www.dell.com/support/kbdoc/000191604
CVE: CVE-2021-36309
Published: 2021-10-01
Description: Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-256, CWE-522
References: https://www.dell.com/support/kbdoc/en-us/000191690/DSA-2021-190-Dell-Enterprise-SONiC-OS-Security-Update-for-an-information-disclosure-Vulnerability; https://www.dell.com/support/kbdoc/en-us/000191690/DSA-2021-190-Dell-Enterprise-SONiC-OS-Security-Update-for-an-information-disclosure-Vulnerability
CVE: CVE-2021-38098
Published: 2021-10-01
Description: Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-027; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-027
CVE: CVE-2021-38100
Published: 2021-10-01
Description: Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-029; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-029
CVE: CVE-2021-38101
Published: 2021-10-01
Description: CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38099.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-028; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-028
CVE: CVE-2021-38102
Published: 2021-10-01
Description: IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38105.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-035; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-035
CVE: CVE-2021-38105
Published: 2021-10-01
Description: IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38102.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-033; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-033
CVE: CVE-2021-38106
Published: 2021-10-01
Description: UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-034; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-034
CVE: CVE-2021-38110
Published: 2021-10-01
Description: Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.fortiguard.com/zeroday/FG-VD-21-036; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-036
CVE: CVE-2021-41847
Published: 2021-10-01
Description: An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://gitlab.com/grose88/infinias; https://grant-rose.com/infinias-access-control-vulnerability/; https://www.3xlogic.com/infinias-access-control
CVE: CVE-2021-38107
Published: 2021-10-02
Description: CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-039; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-039
CVE: CVE-2021-38108
Published: 2021-10-02
Description: Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-037; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-037
CVE: CVE-2021-38109
Published: 2021-10-02
Description: Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.fortiguard.com/zeroday/FG-VD-21-038; https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products; https://www.fortiguard.com/zeroday/FG-VD-21-038
CVE: CVE-2021-41862
Published: 2021-10-02
Description: AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/killme2008/aviatorscript/issues/421; https://github.com/killme2008/aviatorscript/issues/421
CVE: CVE-2021-41864
Published: 2021-10-02
Description: prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.12; https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a; https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
CVE: CVE-2021-41861
Published: 2021-10-04
Description: The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.
CVSS Score: 3.3 (LOW)
References: https://desktop.telegram.org/changelog#v-2-6-23-02-21; https://habr.com/ru/post/580582/; https://pikabu.ru/story/konfidentsialnost_polzovateley_telegram_snova_narushena_predstaviteli_messendzhera_trebuyut_ne_raskryivat_podrobnostey_8511495
CVE: CVE-2021-21704
Published: 2021-10-04
Description: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125, CWE-190, CWE-787
References: https://bugs.php.net/bug.php?id=76448; https://bugs.php.net/bug.php?id=76449; https://bugs.php.net/bug.php?id=76450
CVE: CVE-2021-21705
Published: 2021-10-04
Description: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugs.php.net/bug.php?id=81122; https://security.gentoo.org/glsa/202209-20; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/