deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25357
Published: 2021-04-09
Description: A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(10,0), and 3.6.80.7 in Android R(11.0) allows unprivileged applications to access contact information.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25358
Published: 2021-04-09
Description: A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission via untrusted applications.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-256, CWE-276
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25359
Published: 2021-04-09
Description: An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted applications.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284, CWE-276
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25360
Published: 2021-04-09
Description: An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25361
Published: 2021-04-09
Description: An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary files of system process via untrusted applications.
CVSS Score: 7.9 (HIGH)
CWE: CWE-22
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25362
Published: 2021-04-09
Description: An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25363
Published: 2021-04-09
Description: An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processesdelete some local files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25364
Published: 2021-04-09
Description: A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25365
Published: 2021-04-09
Description: An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access the API in softsimd.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269, CWE-755
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25373
Published: 2021-04-09
Description: Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25374
Published: 2021-04-09
Description: An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.
CVSS Score: 8.6 (HIGH)
CWE: CWE-285
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25375
Published: 2021-04-09
Description: Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open the malicious attachment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-330
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25376
Published: 2021-04-09
Description: An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is failed.
CVSS Score: 3.1 (LOW)
CWE: CWE-200, CWE-662
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25377
Published: 2021-04-09
Description: Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute privileged action.
CVSS Score: 3.3 (LOW)
CWE: CWE-287, CWE-269
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25378
Published: 2021-04-09
Description: Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25379
Published: 2021-04-09
Description: Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-926
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25380
Published: 2021-04-09
Description: Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-703, CWE-755
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25381
Published: 2021-04-09
Description: Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285, CWE-276
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-21194
Published: 2021-04-09
Description: Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html; https://crbug.com/1181228; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21195
Published: 2021-04-09
Description: Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html; https://crbug.com/1182647; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21196
Published: 2021-04-09
Description: Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html; https://crbug.com/1175992; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21197
Published: 2021-04-09
Description: Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html; https://crbug.com/1173903; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21198
Published: 2021-04-09
Description: Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/162973/Chrome-Legacy-ipc-Message-Passed-Via-Shared-Memory.html; https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html; https://crbug.com/1184399
CVE: CVE-2021-21199
Published: 2021-04-09
Description: Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html; https://crbug.com/1179635; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-30480
Published: 2021-04-09
Description: Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
CVSS Score: 8.5 (HIGH)
References: https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/; https://explore.zoom.us/en/trust/security/security-bulletin/; https://sector7.computest.nl/post/2021-08-zoom/
CVE: CVE-2021-20020
Published: 2021-04-10
Description: A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0009; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0009
CVE: CVE-2021-30481
Published: 2021-04-10
Description: Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://news.ycombinator.com/item?id=26762170; https://twitter.com/floesen_/status/[PII_REDACTED]96881666; https://twitter.com/the_secret_club/status/[PII_REDACTED]29296900
CVE: CVE-2021-30485
Published: 2021-04-11
Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp() on a NULL pointer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html; https://sourceforge.net/p/ezxml/bugs/25/; https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE: CVE-2015-20001
Published: 2021-04-11
Description: In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/rust-lang/rust/issues/25842; https://github.com/rust-lang/rust/pull/25856; https://github.com/rust-lang/rust/issues/25842
CVE: CVE-2020-36317
Published: 2021-04-11
Description: In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/rust-lang/rust/issues/78498; https://github.com/rust-lang/rust/pull/78499; https://github.com/rust-lang/rust/issues/78498
CVE: CVE-2020-36318
Published: 2021-04-11
Description: In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-416
References: https://github.com/rust-lang/rust/issues/79808; https://github.com/rust-lang/rust/pull/79814; https://github.com/rust-lang/rust/issues/79808
CVE: CVE-2021-28875
Published: 2021-04-11
Description: In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: https://github.com/rust-lang/rust/issues/80894; https://github.com/rust-lang/rust/pull/80895; https://security.gentoo.org/glsa/202210-09
CVE: CVE-2021-28876
Published: 2021-04-11
Description: In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://github.com/rust-lang/rust/issues/81740; https://github.com/rust-lang/rust/pull/81741; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
CVE: CVE-2021-28877
Published: 2021-04-11
Description: In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/rust-lang/rust/pull/80670; https://security.gentoo.org/glsa/202210-09; https://github.com/rust-lang/rust/pull/80670
CVE: CVE-2021-28878
Published: 2021-04-11
Description: In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/rust-lang/rust/issues/82291; https://github.com/rust-lang/rust/pull/82292; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
CVE: CVE-2021-28879
Published: 2021-04-11
Description: In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/rust-lang/rust/issues/82282; https://github.com/rust-lang/rust/pull/82289; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
CVE: CVE-2021-29379
Published: 2021-04-12
Description: An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cool-y.github.io/2021/03/02/DIR-802-OS-Command-Injection; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10206; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2020-24285
Published: 2021-04-12
Description: INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
CVSS Score: 7.5 (HIGH)
References: http://intelbras.com; https://github.com/SecLoop/CVE/blob/main/telefone_ip_tip200.md; http://intelbras.com
CVE: CVE-2021-23371
Published: 2021-04-12
Description: This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.
CVSS Score: 7.5 (HIGH)
References: https://github.com/wanasit/chrono/commit/98815b57622443b5c498a427210ebd603d705f4c; https://github.com/wanasit/chrono/issues/382; https://snyk.io/vuln/SNYK-JS-CHRONONODE-1083228
CVE: CVE-2020-28872
Published: 2021-04-12
Description: An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: http://packetstormsecurity.com/files/163263/Monitorr-1.7.6m-Bypass-Information-Disclosure-Shell-Upload.html; https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/; https://www.exploit-db.com/exploits/48981
CVE: CVE-2021-23368
Published: 2021-04-12
Description: The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4; https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5; https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc[PII_REDACTED]c8f8bcb778f0627be%40%3Cdev.myfaces.apache.org%3E
CVE: CVE-2021-23369
Published: 2021-04-12
Description: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS Score: 5.6 (MEDIUM)
References: https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8; https://github.com/handlebars-lang/handlebars.js/commit/f[PII_REDACTED]268578199be25285b2ebea1c1e427; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-23370
Published: 2021-04-12
Description: This affects the package swiper before 6.5.1.
CVSS Score: 7.5 (HIGH)
References: https://github.com/nolimits4web/swiper/commit/9dad2739b7474f383474773d5ab898a0c29ac178; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1244698; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1244699
CVE: CVE-2021-24197
Published: 2021-04-12
Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/; https://wpdatatables.com/help/whats-new-changelog/; https://wpscan.com/vulnerability/a56c04a4-dda0-4a7f-a525-d0349a1fda2b
CVE: CVE-2021-24198
Published: 2021-04-12
Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/; https://wpdatatables.com/help/whats-new-changelog/; https://wpscan.com/vulnerability/d953bc62-8a6f-445b-a556-bc25cdd200e3
CVE: CVE-2021-24199
Published: 2021-04-12
Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/; https://wpdatatables.com/help/whats-new-changelog/; https://wpscan.com/vulnerability/5c98c2d6-d002-4cff-9d6f-633cb3ec6280
CVE: CVE-2021-24200
Published: 2021-04-12
Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/; https://wpdatatables.com/help/whats-new-changelog/; https://wpscan.com/vulnerability/21aa7e18-0162-45bf-a5c6-ceee64ffa1f9
CVE: CVE-2021-24213
Published: 2021-04-12
Description: The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bentl.ee/posts/cve-givewp/; https://wpscan.com/vulnerability/da4ab508-a423-4c7f-a1d4-42ec6f989309; https://bentl.ee/posts/cve-givewp/