deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39583
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function pool_lookup_string2() located in pool.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/136; https://github.com/matthiaskramm/swftools/issues/136
CVE: CVE-2021-39584
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function namespace_set_hash() located in pool.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/130; https://github.com/matthiaskramm/swftools/issues/130
CVE: CVE-2021-39585
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function traits_dump() located in abc.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/133; https://github.com/matthiaskramm/swftools/issues/133
CVE: CVE-2021-39587
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function swf_DumpABC() located in abc.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/129; https://github.com/matthiaskramm/swftools/issues/129
CVE: CVE-2021-39588
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function swf_ReadABC() located in abc.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/131; https://github.com/matthiaskramm/swftools/issues/131
CVE: CVE-2021-39589
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function parse_metadata() located in abc.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/132; https://github.com/matthiaskramm/swftools/issues/132
CVE: CVE-2021-39590
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function params_dump() located in abc.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/137; https://github.com/matthiaskramm/swftools/issues/137
CVE: CVE-2021-39591
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function swf_GetShapeBoundingBox() located in swfshape.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/135; https://github.com/matthiaskramm/swftools/issues/135
CVE: CVE-2021-39592
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function pool_lookup_uint() located in pool.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/138; https://github.com/matthiaskramm/swftools/issues/138
CVE: CVE-2021-39593
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function swf_FontExtract_DefineFontInfo() located in swftext.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/139; https://github.com/matthiaskramm/swftools/issues/139
CVE: CVE-2021-39594
Published: 2021-09-20
Description: Other An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function updateusage() located in swftext.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/142; https://github.com/matthiaskramm/swftools/issues/142
CVE: CVE-2021-39595
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A stack-buffer-overflow exists in the function rfx_alloc() located in mem.c. It allows an attacker to cause code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/matthiaskramm/swftools/issues/141; https://github.com/matthiaskramm/swftools/issues/141
CVE: CVE-2021-39596
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function code_parse() located in code.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/146; https://github.com/matthiaskramm/swftools/issues/146
CVE: CVE-2021-39597
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function code_dump2() located in code.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/143; https://github.com/matthiaskramm/swftools/issues/143
CVE: CVE-2021-39598
Published: 2021-09-20
Description: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function callcode() located in code.c. It allows an attacker to cause Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/145; https://github.com/matthiaskramm/swftools/issues/145
CVE: CVE-2020-8561
Published: 2021-09-20
Description: A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-441, CWE-610
References: https://github.com/kubernetes/kubernetes/issues/104720; https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-25740
Published: 2021-09-20
Description: A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
CVSS Score: 3.1 (LOW)
CWE: CWE-441, CWE-610
References: https://github.com/kubernetes/kubernetes/issues/103675; https://groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-25741
Published: 2021-09-20
Description: A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-552
References: https://github.com/kubernetes/kubernetes/issues/104980; https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-29806
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204264.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204264; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204264
CVE: CVE-2021-29807
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204265.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204265; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204265
CVE: CVE-2021-29808
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204269.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204269; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204269
CVE: CVE-2021-29809
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204270.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204270; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204270
CVE: CVE-2021-29811
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 stores user credentials in plain clear text which can be read by an authenticated admin user. IBM X-Force ID: 204329.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204329; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204329
CVE: CVE-2021-29817
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204343.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204343; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204343
CVE: CVE-2021-29818
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204345.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204345; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204345
CVE: CVE-2021-29819
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204346.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204346; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204346
CVE: CVE-2021-29820
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204347.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204347; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204347
CVE: CVE-2021-29821
Published: 2021-09-20
Description: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204348.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204348; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/204348
CVE: CVE-2021-29856
Published: 2021-09-20
Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI Map Creation page. IBM X-Force ID: 205685.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/205685; https://www.ibm.com/support/pages/node/6490747; https://exchange.xforce.ibmcloud.com/vulnerabilities/205685
CVE: CVE-2021-32839
Published: 2021-09-20
Description: sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb; https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-p5w8-wqhj-9hhf; https://github.com/andialbrecht/sqlparse/commit/8238a9e450ed1524e40cb3a8b0b3c00606903aeb
CVE: CVE-2021-38899
Published: 2021-09-20
Description: IBM Cloud Pak for Data 2.5 could allow a local user with special privileges to obtain highly sensitive information. IBM X-Force ID: 209575.
CVSS Score: 4.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209575; https://www.ibm.com/support/pages/node/6490435; https://exchange.xforce.ibmcloud.com/vulnerabilities/209575
CVE: CVE-2021-32838
Published: 2021-09-20
Description: Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/advisories/GHSA-3q6g-vf58-7m4g; https://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f7020589f9d2cc0/flask_restx/inputs.py#L51; https://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd3715f7ed71849656da
CVE: CVE-2020-19915
Published: 2021-09-20
Description: Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/feixuezhi/7a1b117e1a4800efb3b6fffe76ca0e97; https://github.com/wuzhicms/wuzhicms/issues/173; https://gist.github.com/feixuezhi/7a1b117e1a4800efb3b6fffe76ca0e97
CVE: CVE-2020-16630
Published: 2021-09-20
Description: TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile’s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html; https://www.usenix.org/system/files/sec20-zhang-yue.pdf; http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html
CVE: CVE-2020-26301
Published: 2021-09-20
Description: ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21; https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/; https://www.npmjs.com/package/ssh2
CVE: CVE-2021-39325
Published: 2021-09-20
Description: The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2595758%40optinmonster&new=2595758%40optinmonster&sfp_email=&sfph_mail=#file2; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39325; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2595758%40optinmonster&new=2595758%40optinmonster&sfp_email=&sfph_mail=#file2
CVE: CVE-2021-34650
Published: 2021-09-20
Description: The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smart-id/trunk/admin.php?rev=2451347#L30; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34650; https://plugins.trac.wordpress.org/browser/smart-id/trunk/admin.php?rev=2451347#L30
CVE: CVE-2021-41082
Published: 2021-09-20
Description: Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-863
References: https://github.com/discourse/discourse/commit/27bad28c530c89acab35a56b945b6a3924280f4b; https://github.com/discourse/discourse/commit/ddb458343dc39a7a8c99467dcd809b444514fe2c; https://github.com/discourse/discourse/security/advisories/GHSA-vm3x-w6jm-j9vv
CVE: CVE-2021-39229
Published: 2021-09-20
Description: Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359; https://github.com/caronc/apprise/pull/436; https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr
CVE: CVE-2021-41083
Published: 2021-09-20
Description: Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via email, SMS, etc, that - when visited, allows them control of the list control panel as if the bad actor was logged in themselves. This includes changing any mailing list password, as well as the Dada Mail Root Password - which could effectively shut out actual list owners of the mailing list and allow the bad actor complete and unfettered control of your mailing list. This vulnerability also affects profile logins. For this vulnerability to work, the target of the bad actor would need to be logged into the list control panel themselves. This CSRF vulnerability in Dada Mail affects all versions of Dada Mail v11.15.1 and below. Although we know of no known CSRF exploits that have happened in the wild, this vulnerability has been confirmed by our testing, and by a third party. Users are advised to update to version 11.16.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://github.com/justingit/dada-mail/commit/d4d3d86d08c816b4da75a5ef45abc[PII_REDACTED]; https://github.com/justingit/dada-mail/security/advisories/GHSA-344m-p829-2r38; https://github.com/justingit/dada-mail/commit/d4d3d86d08c816b4da75a5ef45abc[PII_REDACTED]
CVE: CVE-2021-20037
Published: 2021-09-21
Description: SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentially allows command execution in the host operating system. This vulnerability impacts GVC 4.10.5 installer and earlier.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0024; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0024
CVE: CVE-2021-20829
Published: 2021-09-21
Description: Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU94889258/index.html; https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/; https://jvn.jp/en/vu/JVNVU94889258/index.html
CVE: CVE-2021-26333
Published: 2021-09-21
Description: An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow low privileged users to open a handle and send requests to the driver resulting in a potential data leak from uninitialized physical pages.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-909
References: http://packetstormsecurity.com/files/164202/AMD-Chipset-Driver-Information-Disclosure-Memory-Leak.html; http://seclists.org/fulldisclosure/2021/Sep/24; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1009