deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-23996
Published: 2021-05-13
Description: A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data.
CVSS Score: 8.8 (HIGH)
References: https://docu.ilias.de/goto_docu_pg_118817_35.html; https://docu.ilias.de/goto_docu_pg_118823_35.html; https://docu.ilias.de/goto_docu_pg_122177_35.html
CVE: CVE-2019-10062
Published: 2021-05-13
Description: The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://aurelia.io; https://github.com/aurelia/templating-resources/blob/0cef07a8cac8e99146d8e1c4b734491bb3dc4724/src/html-sanitizer.js; https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss/
CVE: CVE-2021-31876
Published: 2021-05-13
Description: Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with nSequence = 0xff_ff_ff_ff, spending an unconfirmed parent with nSequence <= 0xff_ff_ff_fd, should be replaceable because there is inherited signaling by the child transaction. However, the actual PreChecks implementation does not enforce this. Instead, mempool rejects the replacement attempt of the unconfirmed child transaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://bitcoinops.org/en/newsletters/2021/05/12/; https://bitcoinops.org/en/topics/replace-by-fee/; https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2021-31876
CVE: CVE-2021-32615
Published: 2021-05-13
Description: Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/commit/2ce1e5952238eba0fe5c5d6537ebdc76cb970b52; https://github.com/Piwigo/Piwigo/issues/1410; https://github.com/Piwigo/Piwigo/commit/2ce1e5952238eba0fe5c5d6537ebdc76cb970b52
CVE: CVE-2021-33026
Published: 2021-05-13
Description: The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/pallets-eco/flask-caching/pull/209#issuecomment[PII_REDACTED]; https://github.com/sh4nks/flask-caching/pull/209; https://github.com/pallets-eco/flask-caching/pull/209#issuecomment[PII_REDACTED]
CVE: CVE-2021-31922
Published: 2021-05-14
Description: An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790
CVE: CVE-2021-32051
Published: 2021-05-14
Description: Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/162534/Hexagon-G-nius-Auskunftsportal-SQL-Injection.html; https://gist.githubusercontent.com/mke1985/a21a71098f48829916dfec74eff1e24a/raw/f635b060ad03e23fd887de48a79b70040daadadb/CVE-2021-32051; https://www.hexagonsafetyinfrastructure.com/products/utilities-and-communications-products/advanced-utility-gis/hexagon-ginius
CVE: CVE-2020-27020
Published: 2021-05-14
Description: Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#270421; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#270421
CVE: CVE-2021-30183
Published: 2021-05-14
Description: Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29[PII_REDACTED].html; https://github.com/OctopusDeploy/Issues; https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29[PII_REDACTED].html
CVE: CVE-2020-27149
Published: 2021-05-14
Description: By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console to have the device’s configuration changed.
CVSS Score: 6.5 (MEDIUM)
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-018%2C; https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-018%2C
CVE: CVE-2020-27150
Published: 2021-05-14
Description: In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensitive data in the original form if “Pre-shared key” doesn’t set.
CVSS Score: 7.5 (HIGH)
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-019%2C; https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-019%2C
CVE: CVE-2021-24188
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24189
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24190
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24191
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24192
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24193
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24194
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24195
Published: 2021-05-14
Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c; https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE: CVE-2021-24277
Published: 2021-05-14
Description: The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4; https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4
CVE: CVE-2021-24278
Published: 2021-05-14
Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413; https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/; https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413
CVE: CVE-2021-24279
Published: 2021-05-14
Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/75f7690d-7f6b-48a8-a9d1-95578a657920; https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/; https://wpscan.com/vulnerability/75f7690d-7f6b-48a8-a9d1-95578a657920
CVE: CVE-2021-24280
Published: 2021-05-14
Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://wpscan.com/vulnerability/db4ba6b0-887e-4ec1-8935-ab21d369b329; https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/; https://wpscan.com/vulnerability/db4ba6b0-887e-4ec1-8935-ab21d369b329
CVE: CVE-2021-24281
Published: 2021-05-14
Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/daf12b85-f5ad-4261-ab39-be6840ad3cdc; https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/; https://wpscan.com/vulnerability/daf12b85-f5ad-4261-ab39-be6840ad3cdc
CVE: CVE-2021-24282
Published: 2021-05-14
Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/def87e69-bade-431b-b101-d463a26406e9; https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/; https://wpscan.com/vulnerability/def87e69-bade-431b-b101-d463a26406e9
CVE: CVE-2021-24283
Published: 2021-05-14
Description: The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6ccd9990-e15f-4800-b499-f7c74b480051; https://wpscan.com/vulnerability/6ccd9990-e15f-4800-b499-f7c74b480051
CVE: CVE-2021-24284
Published: 2021-05-14
Description: The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/167743/WordPress-Kaswara-Modern-WPBakery-Page-Builder-3.0.1-File-Upload.html; https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477; https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5
CVE: CVE-2021-24285
Published: 2021-05-14
Description: The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/24-04-2021-wp-plugin-cars-seller-auto-classifieds-script-sql-injection/; https://wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162; https://codevigilant.com/disclosure/2021/24-04-2021-wp-plugin-cars-seller-auto-classifieds-script-sql-injection/
CVE: CVE-2021-24286
Published: 2021-05-14
Description: The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164328/WordPress-Redirect-404-To-Parent-1.3.0-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/b9a535f3-cb0b-46fe-b345-da3462584e27; http://packetstormsecurity.com/files/164328/WordPress-Redirect-404-To-Parent-1.3.0-Cross-Site-Scripting.html
CVE: CVE-2021-24287
Published: 2021-05-14
Description: The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf; http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html
CVE: CVE-2021-24291
Published: 2021-05-14
Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/162227/; https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873a; https://packetstormsecurity.com/files/162227/
CVE: CVE-2020-27184
Published: 2021-05-14
Description: The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-020%2C; https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-020%2C
CVE: CVE-2020-27185
Published: 2021-05-14
Description: Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data transmitted over Moxa Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-021%2C; https://www.moxa.com/en/support/product-support/security-advisory/nport-ia5000a-serial-device-servers-vulnerabilities; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/05/11/klcert-20-021%2C
CVE: CVE-2021-32613
Published: 2021-05-14
Description: In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=1959939; https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05; https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c[PII_REDACTED]2dd80c6b6d62
CVE: CVE-2020-18166
Published: 2021-05-14
Description: Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md; https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md
CVE: CVE-2020-18167
Published: 2021-05-14
Description: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu".
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md; https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md
CVE: CVE-2020-23689
Published: 2021-05-14
Description: In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/lxw[PII_REDACTED]/YFCMF/issues/2; https://github.com/lxw[PII_REDACTED]/YFCMF/issues/2
CVE: CVE-2021-25941
Published: 2021-05-14
Description: Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/ASaiAnudeep/deep-override/commit/2aced17651fb684959a6e04b1465a8329b3d5268; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25941; https://github.com/ASaiAnudeep/deep-override/commit/2aced17651fb684959a6e04b1465a8329b3d5268
CVE: CVE-2021-25943
Published: 2021-05-14
Description: Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/tjmehta/101/blob/d87f63ce2a4cbdc476e8287abd78327c3144d646/set.js#L52; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25943; https://github.com/tjmehta/101/blob/d87f63ce2a4cbdc476e8287abd78327c3144d646/set.js#L52
CVE: CVE-2020-23691
Published: 2021-05-14
Description: YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/lxw[PII_REDACTED]/YFCMF/issues/1; https://github.com/lxw[PII_REDACTED]/YFCMF/issues/1
CVE: CVE-2020-4811
Published: 2021-05-14
Description: IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation.
CVSS Score: 2.4 (LOW)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189635; https://www.ibm.com/support/pages/node/6453115; https://exchange.xforce.ibmcloud.com/vulnerabilities/189635
CVE: CVE-2020-4985
Published: 2021-05-14
Description: IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192642; https://www.ibm.com/support/pages/node/6452743; https://exchange.xforce.ibmcloud.com/vulnerabilities/192642