deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24130
Published: 2021-03-18
Description: Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/46af9a4d-67ac-4e08-a753-a2a44245f4f8; https://wpscan.com/vulnerability/46af9a4d-67ac-4e08-a753-a2a44245f4f8
CVE: CVE-2021-24131
Published: 2021-03-18
Description: Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user (admin+).
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/1bc28021-28c0-43fa-b89e-6b93c345e5d8; https://wpscan.com/vulnerability/1bc28021-28c0-43fa-b89e-6b93c345e5d8
CVE: CVE-2021-24132
Published: 2021-03-18
Description: The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/c1f45000-6c16-4606-be80-1938a755af2c; https://wpscan.com/vulnerability/c1f45000-6c16-4606-be80-1938a755af2c
CVE: CVE-2021-24133
Published: 2021-03-18
Description: Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/a72a5be4-654b-496f-94cd-3814c0e40120; https://wpscan.com/vulnerability/a72a5be4-654b-496f-94cd-3814c0e40120
CVE: CVE-2021-24134
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/8f3cca92-d072-4806-9142-7f1a987f840b; https://wpscan.com/vulnerability/8f3cca92-d072-4806-9142-7f1a987f840b
CVE: CVE-2021-24135
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/07e9e70b-97a6-42e3-b0de-8cb69dedcbd3; https://wpscan.com/vulnerability/07e9e70b-97a6-42e3-b0de-8cb69dedcbd3
CVE: CVE-2021-24136
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/537ee410-3833-4e88-9d4a-ee3c72b44ca1; https://wpscan.com/vulnerability/537ee410-3833-4e88-9d4a-ee3c72b44ca1
CVE: CVE-2021-24137
Published: 2021-03-18
Description: Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/9eb94e55-765b-4df5-baea-b247ef72aef3; https://wpscan.com/vulnerability/9eb94e55-765b-4df5-baea-b247ef72aef3
CVE: CVE-2021-24138
Published: 2021-03-18
Description: Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151; https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151
CVE: CVE-2021-24139
Published: 2021-03-18
Description: Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28; https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28
CVE: CVE-2021-24140
Published: 2021-03-18
Description: Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/1876312e-3dba-4909-97a5-afbb76fbc056; https://wpscan.com/vulnerability/1876312e-3dba-4909-97a5-afbb76fbc056
CVE: CVE-2021-24141
Published: 2021-03-18
Description: Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/5c8adca0-fe19-4624-81ef-465b8d007f93; https://wpscan.com/vulnerability/5c8adca0-fe19-4624-81ef-465b8d007f93
CVE: CVE-2021-24142
Published: 2021-03-18
Description: Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/19800898-d7b6-4edd-887b-dac3c0597f14; https://wpscan.com/vulnerability/19800898-d7b6-4edd-887b-dac3c0597f14
CVE: CVE-2021-24143
Published: 2021-03-18
Description: Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/02c5e10c-1ac7-447e-8ae5-b6d251be750b; https://wpscan.com/vulnerability/02c5e10c-1ac7-447e-8ae5-b6d251be750b
CVE: CVE-2021-24144
Published: 2021-03-18
Description: Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-74, CWE-1236
References: https://wpscan.com/vulnerability/143cdaff-c536-4ff9-8d64-c617511ddd48; https://wpscan.com/vulnerability/143cdaff-c536-4ff9-8d64-c617511ddd48
CVE: CVE-2021-24145
Published: 2021-03-18
Description: Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html; http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html; https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
CVE: CVE-2021-24146
Published: 2021-03-18
Description: Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-862
References: http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.html; https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc; http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.html
CVE: CVE-2021-24147
Published: 2021-03-18
Description: Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/0f9ba284-5d7e-4092-8344-c68316b0146f; https://wpscan.com/vulnerability/0f9ba284-5d7e-4092-8344-c68316b0146f
CVE: CVE-2021-24148
Published: 2021-03-18
Description: A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882; https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882
CVE: CVE-2021-24149
Published: 2021-03-18
Description: Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/26819680-22a8-4348-b63d-dc52c0d50ed0; https://wpscan.com/vulnerability/26819680-22a8-4348-b63d-dc52c0d50ed0
CVE: CVE-2021-26935
Published: 2021-03-18
Description: In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the event_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-26935; https://www.exploit-db.com/exploits/49657; https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-26935
CVE: CVE-2021-27306
Published: 2021-03-18
Description: An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: https://docs.konghq.com/enterprise/changelog/#core-1; https://medium.com/%40sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3; https://docs.konghq.com/enterprise/changelog/#core-1
CVE: CVE-2021-26215
Published: 2021-03-18
Description: SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://seeddms.com; https://tuhin1729.medium.com/cve-2021-26215-7ce6800be822; http://seeddms.com
CVE: CVE-2021-26216
Published: 2021-03-18
Description: SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://seeddms.com; https://tuhin1729.medium.com/cve-2021-26216-ffb33321dc91; http://seeddms.com
CVE: CVE-2021-28145
Published: 2021-03-18
Description: Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.concrete5.org/developers/introduction/version-history/855-release-notes; https://www.concrete5.org/developers/security; https://documentation.concrete5.org/developers/introduction/version-history/855-release-notes
CVE: CVE-2021-28789
Published: 2021-03-18
Description: The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted apple-swift-format.path configuration value that triggers execution upon opening the workspace.
CVSS Score: 7.8 (HIGH)
References: https://github.com/vknabel/vscode-apple-swift-format/releases/tag/1.1.2; https://vuln.ryotak.me/advisories/11; https://github.com/vknabel/vscode-apple-swift-format/releases/tag/1.1.2
CVE: CVE-2021-28790
Published: 2021-03-18
Description: The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftlint.path configuration value that triggers execution upon opening the workspace.
CVSS Score: 7.8 (HIGH)
References: https://github.com/vknabel/vscode-swiftlint/releases/tag/1.4.5; https://vuln.ryotak.me/advisories/12; https://github.com/vknabel/vscode-swiftlint/releases/tag/1.4.5
CVE: CVE-2021-28791
Published: 2021-03-18
Description: The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution upon opening the workspace.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://github.com/vknabel/vscode-swiftformat/releases/tag/1.3.7; https://vuln.ryotak.me/advisories/13; https://github.com/vknabel/vscode-swiftformat/releases/tag/1.3.7
CVE: CVE-2021-28792
Published: 2021-03-18
Description: The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted sourcekit-lsp.serverPath, swift.languageServerPath, swift.path.sourcekite, swift.path.sourcekiteDockerMode, swift.path.swift_driver_bin, or swift.path.shell configuration value that triggers execution upon opening the workspace.
CVSS Score: 7.8 (HIGH)
References: https://github.com/vknabel/vscode-swift-development-environment/releases/tag/2.12.1; https://vuln.ryotak.me/advisories/14; https://github.com/vknabel/vscode-swift-development-environment/releases/tag/2.12.1
CVE: CVE-2021-28794
Published: 2021-03-18
Description: The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/timonwong/vscode-shellcheck/pull/181; https://github.com/timonwong/vscode-shellcheck/releases/tag/v0.13.4; https://vuln.ryotak.me/advisories/10
CVE: CVE-2021-28796
Published: 2021-03-18
Description: Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/increments/qiita-markdown/compare/v0.32.0...v0.33.0; https://vuln.ryotak.me/advisories/15; https://github.com/increments/qiita-markdown/compare/v0.32.0...v0.33.0
CVE: CVE-2020-26155
Published: 2021-03-18
Description: Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for binaries to be manipulated by non-administrator users. Additionally, entries are made to the PATH environment variable which, in conjunction with these weak permissions, could enable an attacker to perform a DLL hijacking attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-732
References: https://hsm.utimaco.com/products-hardware-security-modules/general-purpose-hsm/; https://secureyourit.co.uk/wp/2021/03/13/utimaco-cve-2020-26155/; https://hsm.utimaco.com/products-hardware-security-modules/general-purpose-hsm/
CVE: CVE-2020-27827
Published: 2021-03-18
Description: A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1921438; https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/
CVE: CVE-2021-21383
Published: 2021-03-18
Description: Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained within a `<pre>` element. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. For an example see referenced GitHub Security Advisory. Commit 5ffa189383dd716f12b56b8cae2ba0d075996cf1 fixes this vulnerability by adding the v-pre directive to all `<pre>` tags during the render.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/Requarks/wiki/commit/5ffa189383dd716f12b56b8cae2ba0d075996cf1; https://github.com/Requarks/wiki/releases/tag/2.5.191; https://github.com/Requarks/wiki/security/advisories/GHSA-6xx4-m8gx-826r
CVE: CVE-2020-14516
Published: 2021-03-18
Description: In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm with FactoryTalk Services Platform that prevents the user password from being hashed properly.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-916
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-054-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-054-01
CVE: CVE-2021-22665
Published: 2021-03-18
Description: Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129798; https://us-cert.cisa.gov/ics/advisories/icsa-21-042-02; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129798
CVE: CVE-2021-27656
Published: 2021-03-18
Description: A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-077-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://us-cert.cisa.gov/ics/advisories/icsa-21-077-01
CVE: CVE-2019-14848
Published: 2021-03-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-14850
Published: 2021-03-18
Description: A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
CVSS Score: 3.7 (LOW)
CWE: CWE-406
References: https://bugzilla.redhat.com/show_bug.cgi?id=1757258; https://www.redhat.com/archives/libguestfs/2019-September/msg00084.html; https://bugzilla.redhat.com/show_bug.cgi?id=1757258
CVE: CVE-2019-14903
Published: 2021-03-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-14908
Published: 2021-03-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-3867
Published: 2021-03-18
Description: A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-613
References: https://bugzilla.redhat.com/show_bug.cgi?id=1772704; https://bugzilla.redhat.com/show_bug.cgi?id=1772704
CVE: CVE-2020-35492
Published: 2021-03-18
Description: A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1898396; https://security.gentoo.org/glsa/202305-21; https://bugzilla.redhat.com/show_bug.cgi?id=1898396
CVE: CVE-2021-1287
Published: 2021-03-18
Description: A vulnerability in the web-based management interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-132w134w-overflow-Pptt4H2p; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-132w134w-overflow-Pptt4H2p
CVE: CVE-2021-28160
Published: 2021-03-18
Description: Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990; https://www.amazon.com/Extender-Wireless-Repeater-External-Antennas/dp/B08GMCC6X2/; https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990
CVE: CVE-2019-14851
Published: 2021-03-18
Description: A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1757259; https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html; https://bugzilla.redhat.com/show_bug.cgi?id=1757259
CVE: CVE-2019-14852
Published: 2021-03-18
Description: A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://bugzilla.redhat.com/show_bug.cgi?id=1758208; https://bugzilla.redhat.com/show_bug.cgi?id=1758208