deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43858
Published: 2021-12-27
Description: MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-863
References: https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf; https://github.com/minio/minio/pull/13976; https://github.com/minio/minio/pull/7949
CVE: CVE-2021-45884
Published: 2021-12-27
Description: In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/brave/brave-browser/issues/19070; https://github.com/brave/brave-browser/issues/20079; https://github.com/brave/brave-core/pull/10742
CVE: CVE-2021-45896
Published: 2021-12-27
Description: Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.
CVSS Score: 8.8 (HIGH)
References: https://eddiez.me/hacking-the-nokia-fastmile/; https://gist.github.com/thedroidgeek/80c379aa43b71015d71da130f85a435a; https://eddiez.me/hacking-the-nokia-fastmile/
CVE: CVE-2020-21236
Published: 2021-12-27
Description: A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/wind-cyber/DamiCMS-v6.0.0-have-csrf-and-xss-Vulnerabilities-/blob/master/README.md; https://github.com/wind-cyber/DamiCMS-v6.0.0-have-csrf-and-xss-Vulnerabilities-/blob/master/README.md
CVE: CVE-2020-21237
Published: 2021-12-27
Description: An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/wind-cyber/LJCMS-UserTraversal-Vulnerability; https://github.com/wind-cyber/LJCMS-UserTraversal-Vulnerability
CVE: CVE-2020-21238
Published: 2021-12-27
Description: An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/chshcms/cscms/issues/5; https://github.com/chshcms/cscms/issues/5
CVE: CVE-2021-45904
Published: 2021-12-27
Description: OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.openwrt.org/index.php?do=details&task_id=4199; https://bugs.openwrt.org/index.php?do=details&task_id=4199
CVE: CVE-2021-45905
Published: 2021-12-27
Description: OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.openwrt.org/index.php?do=details&task_id=4199; https://bugs.openwrt.org/index.php?do=details&task_id=4199
CVE: CVE-2021-45906
Published: 2021-12-27
Description: OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.openwrt.org/index.php?do=details&task_id=4199; https://bugs.openwrt.org/index.php?do=details&task_id=4199
CVE: CVE-2021-45907
Published: 2021-12-28
Description: An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669
CVE: CVE-2021-45908
Published: 2021-12-28
Description: An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669
CVE: CVE-2021-45909
Published: 2021-12-28
Description: An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacker to write a large amount of arbitrary data outside the boundaries of a buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002668; https://lists.debian.org/debian-lts-announce/2022/03/msg00008.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002668
CVE: CVE-2021-45910
Published: 2021-12-28
Description: An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data outside of the allocated buffer. The attacker has control over a part of the address that data is written to, control over the written data, and (to some extent) control over the amount of data that is written.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002667; https://lists.debian.org/debian-lts-announce/2022/03/msg00008.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002667
CVE: CVE-2021-45911
Published: 2021-12-28
Description: An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes outside the boundaries of the buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002687; https://lists.debian.org/debian-lts-announce/2022/03/msg00008.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002687
CVE: CVE-2021-20873
Published: 2021-12-28
Description: Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may be directed to unintended sites via a specially crafted URL.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://jvn.jp/en/jp/JVN66422035/index.html; https://support.yappli.co.jp/hc/ja/articles/[PII_REDACTED]745; https://jvn.jp/en/jp/JVN66422035/index.html
CVE: CVE-2021-4177
Published: 2021-12-28
Description: livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/livehelperchat/livehelperchat/commit/b280beae2e0de37b9e998c31c5d[PII_REDACTED]fc1; https://huntr.dev/bounties/ac641425-1c64-4874-95e7-c7805c72074e; https://github.com/livehelperchat/livehelperchat/commit/b280beae2e0de37b9e998c31c5d[PII_REDACTED]fc1
CVE: CVE-2021-4179
Published: 2021-12-28
Description: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/c3881fb528af349bf47f9ccbf83c994087faa3e6; https://huntr.dev/bounties/8df06513-c57d-4a55-9798-0a1f6c153535; https://github.com/livehelperchat/livehelperchat/commit/c3881fb528af349bf47f9ccbf83c994087faa3e6
CVE: CVE-2021-35031
Published: 2021-12-28
Description: A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml; https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml
CVE: CVE-2021-35032
Published: 2021-12-28
Description: A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml; https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml
CVE: CVE-2021-40579
Published: 2021-12-28
Description: https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access Control. The impact is: gain privileges (remote).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://medium.com/%40VAPT01/cve-2021-40579-9eac3409fd24; https://www.sourcecodester.com/; https://medium.com/%40VAPT01/cve-2021-40579-9eac3409fd24
CVE: CVE-2018-17875
Published: 2021-12-28
Description: A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: http://unkl4b.github.io/Authenticated-RCE-in-Polycom-Trio-8800-pt-1/; https://support.polycom.com/content/support/emea/emea/en/support/voice/polycom-trio/polycom-trio-8800.html; http://unkl4b.github.io/Authenticated-RCE-in-Polycom-Trio-8800-pt-1/
CVE: CVE-2019-20082
Published: 2021-12-28
Description: ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/pr0v3rbs/CVE/tree/master/CVE-2019-20082; https://www.asus.com; https://github.com/pr0v3rbs/CVE/tree/master/CVE-2019-20082
CVE: CVE-2021-37400
Published: 2021-12-28
Description: An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://jvn.jp/en/vu/JVNVU92279973/; https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A; https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
CVE: CVE-2021-37401
Published: 2021-12-28
Description: An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://jvn.jp/en/vu/JVNVU92279973/; https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A; https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
CVE: CVE-2021-45425
Published: 2021-12-28
Description: Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/165439/Safari-Montage-8.5-Cross-Site-Scripting.html; https://drive.google.com/file/d/1IgGyzU_ekMZf8yWq46DwtIaVsBf3gt2U/view?usp=sharing; https://drive.google.com/file/d/1yVuCfovUpqwp6KKZW1togf5PigxXQ3dh/view?usp=sharing
CVE: CVE-2021-45903
Published: 2021-12-28
Description: A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35; https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_2; https://github.com/ach-ing/cves/blob/main/CVE-2021-45903.md
CVE: CVE-2021-45812
Published: 2021-12-28
Description: NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing; https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing
CVE: CVE-2021-45813
Published: 2021-12-28
Description: SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting malicious JavaScript codes which leads to Session Hijacking and cause user's credentials theft.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1oKuzCZob9-LOAp-pdGN0MYYBx8y9FnHK/view?usp=sharing; https://drive.google.com/file/d/1oKuzCZob9-LOAp-pdGN0MYYBx8y9FnHK/view?usp=sharing
CVE: CVE-2021-45814
Published: 2021-12-28
Description: Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165438/Nettmp-NNT-5.1-SQL-Injection.html; https://drive.google.com/file/d/1-WiC1RDbcUqNB5sYd2h2n4rcU873s3gM/view?usp=sharing; https://drive.google.com/file/d/1WS_pa2PzLS1EplBu7pjx7hXlyBwCepP9/view?usp=sharing
CVE: CVE-2016-3103
Published: 2021-12-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: non
CVE: CVE-2016-3736
Published: 2021-12-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: non
CVE: CVE-2021-23151
Published: 2021-12-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-3090
Published: 2021-12-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43553. Reason: This candidate is a reservation duplicate of CVE-2021-43553. Notes: All CVE users should reference CVE-2021-43553 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-3095
Published: 2021-12-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43551. Reason: This candidate is a reservation duplicate of CVE-2021-43551. Notes: All CVE users should reference CVE-2021-43551 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-42583
Published: 2021-12-28
Description: A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://github.com/foxcpp/maddy/blob/df40dce1284cd0fd0a9e8e[PII_REDACTED]d653d0a5/internal/auth/shadow/verify.go; https://github.com/foxcpp/maddy/releases/tag/v0.5.2; https://github.com/foxcpp/maddy/blob/df40dce1284cd0fd0a9e8e[PII_REDACTED]d653d0a5/internal/auth/shadow/verify.go
CVE: CVE-2021-43554
Published: 2021-12-28
Description: FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-320-01; https://www.zerodayinitiative.com/advisories/ZDI-22-028/; https://www.zerodayinitiative.com/advisories/ZDI-22-030/
CVE: CVE-2021-43556
Published: 2021-12-28
Description: FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-320-01; https://www.zerodayinitiative.com/advisories/ZDI-22-029/; https://www.zerodayinitiative.com/advisories/ZDI-22-031/
CVE: CVE-2021-44771
Published: 2021-12-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-22057
Published: 2021-12-28
Description: The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default security descriptor which allows attackers to access sensitive components and data.
CVSS Score: 9.1 (CRITICAL)
References: https://gist.github.com/hfiref0x/859f88bfa8adde49ea16fad7d58e3b37; https://gist.github.com/hfiref0x/859f88bfa8adde49ea16fad7d58e3b37
CVE: CVE-2020-22061
Published: 2021-12-28
Description: SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows attackers to arbitrarily write data to the device via IOCTL 0x9C402140.
CVSS Score: 7.8 (HIGH)
References: https://gist.github.com/hfiref0x/7e66d943984cceac60eb812ac1bf8208; https://gist.github.com/hfiref0x/7e66d943984cceac60eb812ac1bf8208
CVE: CVE-2020-7878
Published: 2021-12-28
Description: An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-353, CWE-345
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36349; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36349
CVE: CVE-2020-7883
Published: 2021-12-28
Description: Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494, CWE-494
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36350; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36350
CVE: CVE-2021-44832
Published: 2021-12-28
Description: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20, CWE-74, CWE-20
References: http://www.openwall.com/lists/oss-security/2021/12/28/1; https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf; https://issues.apache.org/jira/browse/LOG4J2-3293
CVE: CVE-2021-44160
Published: 2021-12-29
Description: Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user.
CVSS Score: 7.3 (HIGH)
CWE: CWE-639
References: https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html; https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html
CVE: CVE-2021-44161
Published: 2021-12-29
Description: Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-5423-84a13-1.html; https://www.twcert.org.tw/tw/cp-132-5423-84a13-1.html
CVE: CVE-2021-25988
Published: 2021-12-29
Description: In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ifmeorg/ifme/commit/720a47015e46ad387b3219fed7ebfb14ec3c854c; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25988; https://github.com/ifmeorg/ifme/commit/720a47015e46ad387b3219fed7ebfb14ec3c854c
CVE: CVE-2021-25989
Published: 2021-12-29
Description: In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ifmeorg/ifme/commit/df4986f0721a72779403d21d36c025fe95edffad; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25989; https://github.com/ifmeorg/ifme/commit/df4986f0721a72779403d21d36c025fe95edffad
CVE: CVE-2021-25990
Published: 2021-12-29
Description: In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ifmeorg/ifme/commit/83fd44ef8921a8dcf394a012e44901ab08596bdc; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25990; https://github.com/ifmeorg/ifme/commit/83fd44ef8921a8dcf394a012e44901ab08596bdc
CVE: CVE-2021-25991
Published: 2021-12-29
Description: In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-284
References: https://github.com/ifmeorg/ifme/commit/d1f570c458d41667df801fc9c40a18b181a2d923; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25991; https://github.com/ifmeorg/ifme/commit/d1f570c458d41667df801fc9c40a18b181a2d923
CVE: CVE-2021-35034
Published: 2021-12-29
Description: An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.
CVSS Score: 7.4 (HIGH)
CWE: CWE-613, CWE-613
References: https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml; https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml
CVE: CVE-2021-35035
Published: 2021-12-29
Description: A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive information from the configuration file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml; https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml
CVE: CVE-2021-38680
Published: 2021-12-29
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-54; https://www.qnap.com/en/security-advisory/qsa-21-54