deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21893
Published: 2021-08-05
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.0.0.49893. A specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1336; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1336
CVE: CVE-2021-22234
Published: 2021-08-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22234.json; https://gitlab.com/gitlab-org/gitlab/-/issues/335205; https://hackerone.com/reports/1212067
CVE: CVE-2021-22517
Published: 2021-08-05
Description: A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector. The vulnerability affects versions 10.10, 10.20, 10.30, 10.40, 10.50, 10.60, 10.70, 10.80, 10.0 and 10.91. A privileged user may potentially misuse this feature and thus allow unintended and unauthorized access of data.
CVSS Score: 8.8 (HIGH)
References: https://portal.microfocus.com/s/article/KM000001460; https://portal.microfocus.com/s/article/KM000001460
CVE: CVE-2021-22919
Published: 2021-08-05
Description: A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://support.citrix.com/article/CTX319135; https://support.citrix.com/article/CTX319135
CVE: CVE-2021-22920
Published: 2021-08-05
Description: A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.citrix.com/article/CTX319135; https://support.citrix.com/article/CTX319135
CVE: CVE-2021-22922
Published: 2021-08-05
Description: When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-840, CWE-755
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1213175; https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E
CVE: CVE-2021-22923
Published: 2021-08-05
Description: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319, CWE-522
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1213181; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
CVE: CVE-2021-22924
Published: 2021-08-05
Description: libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
CVSS Score: 3.7 (LOW)
CWE: CWE-20, CWE-706
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
CVE: CVE-2021-22925
Published: 2021-08-05
Description: curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-908
References: http://seclists.org/fulldisclosure/2021/Sep/39; http://seclists.org/fulldisclosure/2021/Sep/40; https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE: CVE-2021-22926
Published: 2021-08-05
Description: libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.
CVSS Score: 7.5 (HIGH)
CWE: CWE-840, CWE-295
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1234760; https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E
CVE: CVE-2021-22927
Published: 2021-08-05
Description: A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384, CWE-384
References: https://support.citrix.com/article/CTX319135; https://support.citrix.com/article/CTX319135
CVE: CVE-2021-22928
Published: 2021-08-05
Description: A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM.
CVSS Score: 7.8 (HIGH)
References: https://support.citrix.com/article/CTX319750; https://support.citrix.com/article/CTX319750
CVE: CVE-2021-26586
Published: 2021-08-05
Description: A potential security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to disclose sensitive information. HPE has made software updates available to resolve the vulnerability in the HPE Edgeline Infrastructure Manager (EIM).
CVSS Score: 7.5 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04180en_us; https://www.tenable.com/security/research/tra-2021-33; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04180en_us
CVE: CVE-2021-26605
Published: 2021-08-05
Description: An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launcher received and executed crafted input values through JSON-RPC communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36168; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36168
CVE: CVE-2021-28216
Published: 2021-08-05
Description: BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-587, CWE-763
References: https://bugzilla.tianocore.org/show_bug.cgi?id=2957; https://bugzilla.tianocore.org/show_bug.cgi?id=2957; https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html
CVE: CVE-2021-32002
Published: 2021-08-05
Description: Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://www.secomea.com/support/cybersecurity-advisory; https://www.secomea.com/support/cybersecurity-advisory
CVE: CVE-2021-32003
Published: 2021-08-05
Description: Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used after provisioning. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.
CVSS Score: 8.0 (HIGH)
CWE: CWE-523, CWE-522
References: https://www.secomea.com/support/cybersecurity-advisory; https://www.secomea.com/support/cybersecurity-advisory
CVE: CVE-2021-34633
Published: 2021-08-05
Description: The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/youtube-feeder/trunk/youtube-feeder.php#L669; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34633; https://plugins.trac.wordpress.org/browser/youtube-feeder/trunk/youtube-feeder.php#L669
CVE: CVE-2021-34634
Published: 2021-08-05
Description: The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/sola-newsletters/trunk/sola-newsletters.php#L774; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34634; https://plugins.trac.wordpress.org/browser/sola-newsletters/trunk/sola-newsletters.php#L774
CVE: CVE-2021-34638
Published: 2021-08-05
Description: Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-79, CWE-540, CWE-22
References: https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/; https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/
CVE: CVE-2021-34639
Published: 2021-08-05
Description: Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-646, CWE-434
References: https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/; https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/
CVE: CVE-2021-35324
Published: 2021-08-05
Description: A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_login_bypass.md; https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_login_bypass.md
CVE: CVE-2021-35325
Published: 2021-08-05
Description: A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_cookie_overflow.md; https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_cookie_overflow.md
CVE: CVE-2021-35326
Published: 2021-08-05
Description: A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
References: https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_leak_config_file.md; https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_leak_config_file.md
CVE: CVE-2021-35327
Published: 2021-08-05
Description: A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_default_telnet_info.md; https://github.com/hurricane618/my_cves/blob/master/router/totolink/A720R_default_telnet_info.md
CVE: CVE-2021-37156
Published: 2021-08-05
Description: Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://www.redmine.org/news/132; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://www.redmine.org/news/132
CVE: CVE-2021-37632
Published: 2021-08-05
Description: SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642's Config Lib, servers will send a packet to clients with the server's config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642's Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6; https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6
CVE: CVE-2021-3566
Published: 2021-08-05
Description: Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/FFmpeg/FFmpeg/commit/3bce9e9b3ea35c54bacccc793d7da99ea5157532#diff-74f6b92a0541378ad15de9c29c0a2b0c69881ad9ffc71abe568b88b535e00a7f; https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://github.com/FFmpeg/FFmpeg/commit/3bce9e9b3ea35c54bacccc793d7da99ea5157532#diff-74f6b92a0541378ad15de9c29c0a2b0c69881ad9ffc71abe568b88b535e00a7f
CVE: CVE-2021-3580
Published: 2021-08-05
Description: A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967983; https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html; https://security.gentoo.org/glsa/202401-24
CVE: CVE-2021-3591
Published: 2021-08-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-3642
Published: 2021-08-05
Description: A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://bugzilla.redhat.com/show_bug.cgi?id=1981407; https://bugzilla.redhat.com/show_bug.cgi?id=1981407
CVE: CVE-2021-3655
Published: 2021-08-05
Description: A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.
CVSS Score: 3.3 (LOW)
CWE: CWE-909, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1984024; https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html; https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE: CVE-2020-22392
Published: 2021-08-05
Description: Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/issues/868; https://github.com/intelliants/subrion/issues/868
CVE: CVE-2021-32587
Published: 2021-08-06
Description: An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.
CVSS Score: 4.3 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-21-059; https://fortiguard.com/advisory/FG-IR-21-059
CVE: CVE-2021-32597
Published: 2021-08-06
Description: Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-21-054; https://fortiguard.com/advisory/FG-IR-21-054
CVE: CVE-2021-37388
Published: 2021-08-06
Description: A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver and might even gain remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/noobexploiter/IOTHACKS/blob/main/vuln1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/noobexploiter/IOTHACKS/blob/main/vuln1.md
CVE: CVE-2021-38149
Published: 2021-08-06
Description: index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://chikitsa.net/; https://github.com/jboogie15/CVE-2021-38149; https://chikitsa.net/
CVE: CVE-2021-38151
Published: 2021-08-06
Description: index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://chikitsa.net/; https://github.com/jboogie15/CVE-2021-38149; https://chikitsa.net/
CVE: CVE-2021-38152
Published: 2021-08-06
Description: index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163816/Chikitsa-2.0.0-Cross-Site-Scripting.html; https://chikitsa.net/; https://github.com/jboogie15/CVE-2021-38149
CVE: CVE-2021-22295
Published: 2021-08-06
Description: A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://device.harmonyos.com/cn/console/safetyDetail?id=9145efa5d9064d94a7fc3968b6054d83&pageSize=10&pageIndex=1; https://device.harmonyos.com/cn/console/safetyDetail?id=9145efa5d9064d94a7fc3968b6054d83&pageSize=10&pageIndex=1
CVE: CVE-2021-37381
Published: 2021-08-06
Description: Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed through /gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2]. Among them, the code in [1] is a random string generated according to the user's login related information. It can protect the user's identity, but it can not effectively prevent unauthorized access. The code in [2] is the student number of any student. The attacker can carry out CSRF attack on the system by modifying [2] without modifying [1].
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/caiteli/poc_information/blob/main/southsoft_GMIS.txt; https://github.com/caiteli/poc_information/issues/1; https://github.com/caiteli/poc_information/blob/main/southsoft_GMIS.txt
CVE: CVE-2020-22330
Published: 2021-08-06
Description: Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/issues/850; https://github.com/intelliants/subrion/issues/850