deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21340
Published: 2021-03-23
Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-fjh3-g8gq-9q92; https://packagist.org/packages/typo3/cms-backend; https://typo3.org/security/advisory/typo3-core-sa-2021-007
CVE: CVE-2021-21355
Published: 2021-03-23
Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in their direct or inherited domain model definitions and did not implement their own type converter. In case this scenario applies, _UploadedFileReferenceConverter_ accepts any file mime-type and persists files in the default location. In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-434, CWE-552
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-2r6j-862c-m2v2; https://packagist.org/packages/typo3/cms-form; https://typo3.org/security/advisory/typo3-core-sa-2021-002
CVE: CVE-2021-21357
Published: 2021-03-23
Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-22, CWE-434
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-3vg7-jw9m-pc3f; https://packagist.org/packages/typo3/cms-form; https://typo3.org/security/advisory/typo3-core-sa-2021-003
CVE: CVE-2021-21358
Published: 2021-03-23
Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-x79j-wgqv-g8h2; https://packagist.org/packages/typo3/cms-form; https://typo3.org/security/advisory/typo3-core-sa-2021-004
CVE: CVE-2021-21359
Published: 2021-03-23
Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-405, CWE-674
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397p; https://packagist.org/packages/typo3/cms-core; https://typo3.org/security/advisory/typo3-core-sa-2021-005
CVE: CVE-2021-21370
Published: 2021-03-23
Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-x7hc-x7fm-f7qh; https://packagist.org/packages/typo3/cms-backend; https://typo3.org/security/advisory/typo3-core-sa-2021-008
CVE: CVE-2021-29065
Published: 2021-03-23
Description: NETGEAR RBR850 devices before 3.2.10.11 are affected by authentication bypass.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000063006/Security-Advisory-for-Authentication-Bypass-on-RBR850-PSV-2020-0029; https://kb.netgear.com/000063006/Security-Advisory-for-Authentication-Bypass-on-RBR850-PSV-2020-0029
CVE: CVE-2021-29066
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000063014/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0484; https://kb.netgear.com/000063014/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0484
CVE: CVE-2021-29067
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by authentication bypass. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000063017/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0492; https://kb.netgear.com/000063017/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0492
CVE: CVE-2021-29068
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before 1.0.4.98, R7000 before 1.0.11.106, R6900P before 1.3.2.124, R7000P before 1.3.2.124, R7900 before 1.0.4.26, R7850 before 1.0.5.60, R8000 before 1.0.4.58, RS400 before 1.5.0.48, R6400 before 1.0.1.62, R6700 before 1.0.2.16, R6900 before 1.0.2.16, MK60 before 1.0.5.102, MR60 before 1.0.5.102, MS60 before 1.0.5.102, CBR40 before 2.5.0.10, R8000P before 1.4.1.62, R7960P before 1.4.1.62, R7900P before 1.4.1.62, RAX15 before 1.0.1.64, RAX20 before 1.0.1.64, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, RAX200 before 1.0.2.102, RAX45 before 1.0.2.64, RAX50 before 1.0.2.64, EX7500 before 1.0.0.68, EAX80 before 1.0.1.62, EAX20 before 1.0.0.36, RBK752 before 3.2.16.6, RBK753 before 3.2.16.6, RBK753S before 3.2.16.6, RBK754 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBK853 before 3.2.16.6, RBK854 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, RBR840 before 3.2.16.6, RBS840 before 3.2.16.6, R6120 before 1.0.0.70, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.76, R6850 before 1.1.0.76, R6350 before 1.1.0.76, R6330 before 1.1.0.76, D7800 before 1.0.1.58, RBK50 before 2.6.1.40, RBR50 before 2.6.1.40, RBS50 before 2.6.1.40, RBK40 before 2.6.1.36, RBR40 before 2.6.1.36, RBS40 before 2.6.1.38, RBK23 before 2.6.1.36, RBR20 before 2.6.1.38, RBS20 before 2.6.1.38, RBK12 before 2.6.1.44, RBK13 before 2.6.1.44, RBK14 before 2.6.1.44, RBK15 before 2.6.1.44, RBR10 before 2.6.1.44, RBS10 before 2.6.1.44, R6800 before 1.2.0.72, R6900v2 before 1.2.0.72, R6700v2 before 1.2.0.72, R7200 before 1.2.0.72, R7350 before 1.2.0.72, R7400 before 1.2.0.72, R7450 before 1.2.0.72, AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 before 1.2.0.72, R7800 before 1.0.2.74, R8900 before 1.0.5.24, R9000 before 1.0.5.24, RAX120 before 1.0.1.136, XR450 before 2.3.2.66, XR500 before 2.3.2.66, XR700 before 1.0.1.34, and XR300 before 1.0.3.50.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://kb.netgear.com/000063021/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0155; https://kb.netgear.com/000063021/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0155
CVE: CVE-2021-29069
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114, XR500 before 2.3.2.114, and WNR2000v5 before 1.0.0.76.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000063023/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0595; https://kb.netgear.com/000063023/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0595
CVE: CVE-2021-29070
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000063019/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Routers-PSV-2020-0530; https://kb.netgear.com/000063019/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Routers-PSV-2020-0530
CVE: CVE-2021-29071
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBR752 before 3.2.17.12, RBR753 before 3.2.17.12, RBR753S before 3.2.17.12, RBR754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000063008/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0476; https://kb.netgear.com/000063008/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0476
CVE: CVE-2021-29072
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000063018/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0493; https://kb.netgear.com/000063018/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0493
CVE: CVE-2021-29073
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8000P before 1.4.1.66, MK62 before 1.0.6.110, MR60 before 1.0.6.110, MS60 before 1.0.6.110, R7960P before 1.4.1.66, R7900P before 1.4.1.66, RAX15 before 1.0.2.82, RAX20 before 1.0.2.82, RAX45 before 1.0.2.72, RAX50 before 1.0.2.72, RAX75 before 1.0.3.106, RAX80 before 1.0.3.106, and RAX200 before 1.0.3.106.
CVSS Score: 7.6 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000063013/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2020-0212; https://kb.netgear.com/000063013/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2020-0212
CVE: CVE-2021-29074
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 before 2.6.2.2, RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000063011/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-WiFi-Routers-PSV-2020-0467; https://kb.netgear.com/000063011/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-WiFi-Routers-PSV-2020-0467
CVE: CVE-2021-29075
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects RBW30 before 2.6.2.2, RBK852 before 3.2.17.12, RBK852 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000063010/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-WiFi-Systems-PSV-2020-0466; https://kb.netgear.com/000063010/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-WiFi-Systems-PSV-2020-0466
CVE: CVE-2021-29076
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000063015/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0485; https://kb.netgear.com/000063015/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0485
CVE: CVE-2021-29077
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000063016/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0486; https://kb.netgear.com/000063016/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0486
CVE: CVE-2021-29078
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000063009/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0511; https://kb.netgear.com/000063009/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0511
CVE: CVE-2021-29079
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000063020/Security-Advisory-for-Pre-Authentication-Command-Injection-Some-WiFi-Routers-PSV-2020-0470; https://kb.netgear.com/000063020/Security-Advisory-for-Pre-Authentication-Command-Injection-Some-WiFi-Routers-PSV-2020-0470
CVE: CVE-2021-29080
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 before 2.5.0.10, R7000 before 1.0.11.116, R6900P before 1.3.2.126, R7900 before 1.0.4.38, R7960P before 1.4.1.66, R8000 before 1.0.4.66, R7900P before 1.4.1.66, R8000P before 1.4.1.66, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, and R7000P before 1.3.2.126.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://kb.netgear.com/000063007/Security-Advisory-for-Pre-authentication-Password-Reset-on-Some-Routers-and-WiFi-Systems-PSV-2019-0150; https://kb.netgear.com/000063007/Security-Advisory-for-Pre-authentication-Password-Reset-on-Some-Routers-and-WiFi-Systems-PSV-2019-0150
CVE: CVE-2021-29081
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000063012/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-WiFi-Systems-PSV-2020-0465; https://kb.netgear.com/000063012/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-WiFi-Systems-PSV-2020-0465
CVE: CVE-2021-29082
Published: 2021-03-23
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBW30 before 2.6.1.4, RBS40V before 2.6.1.4, RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBK754 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBK854 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000063005/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-WiFi-Systems-PSV-2020-0037; https://kb.netgear.com/000063005/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-WiFi-Systems-PSV-2020-0037
CVE: CVE-2020-28503
Published: 2021-03-23
Description: The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
CVSS Score: 7.3 (HIGH)
References: https://github.com/gulpjs/copy-props/pull/7; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088047; https://snyk.io/vuln/SNYK-JS-COPYPROPS-1082870
CVE: CVE-2021-23361
Published: 2021-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-27309
Published: 2021-03-23
Description: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22module%22%20xss.md; https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22module%22%20xss.md
CVE: CVE-2021-27310
Published: 2021-03-23
Description: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22language%22%20xss.md; https://github.com/xoffense/POC/blob/main/Clansphere%202011.4%20%22language%22%20xss.md
CVE: CVE-2021-27526
Published: 2021-03-23
Description: A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20page%20parameter; https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20page%20parameter
CVE: CVE-2021-27527
Published: 2021-03-23
Description: A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20valueID%20parameter; https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20valueID%20parameter
CVE: CVE-2021-27528
Published: 2021-03-23
Description: A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20refID%20parameter; https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20refID%20parameter
CVE: CVE-2021-27529
Published: 2021-03-23
Description: A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20limit%20parameter; https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20limit%20parameter
CVE: CVE-2021-27530
Published: 2021-03-23
Description: A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20index.php%20URI; https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20index.php%20URI
CVE: CVE-2021-27531
Published: 2021-03-23
Description: A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20query%20parameter; https://github.com/xoffense/POC/blob/main/DynPG%204.9.2%20XSS%20via%20query%20parameter
CVE: CVE-2021-27969
Published: 2021-03-23
Description: Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1suqBvuoE-3U2QmWpCOXXV4_5rEu_XGJL/view?usp=sharing; https://www.exploit-db.com/exploits/49670; https://drive.google.com/file/d/1suqBvuoE-3U2QmWpCOXXV4_5rEu_XGJL/view?usp=sharing
CVE: CVE-2020-7346
Published: 2021-03-23
Description: Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attacker along with sending a specific IOTL command at the correct time.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10344; https://kc.mcafee.com/corporate/index?page=content&id=SB10344