deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27260
Published: 2021-04-14
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12068.
CVSS Score: 3.2 (LOW)
CWE: CWE-125
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-213/; https://kb.parallels.com/en/125013
CVE: CVE-2021-27708
Published: 2021-04-14
Description: Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "command" parameter is directly passed to the attacker, allowing them to control the "command" field to attack the OS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://hackmd.io/7FtB06f-SJ-SCfkMYcXYxA; https://hackmd.io/mDgIBvoxSPCZrZiZjfQGhw; https://hackmd.io/7FtB06f-SJ-SCfkMYcXYxA
CVE: CVE-2020-35418
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2020/12/group-office-crm-stored-xss-via-svg-file.html; https://fatihhcelik.blogspot.com/2020/12/group-office-crm-stored-xss-via-svg-file.html
CVE: CVE-2020-35419
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.github.io/posts/Group-Office-CRM-Stored-XSS-via-SVG-File/; https://fatihhcelik.github.io/posts/Group-Office-CRM-Stored-XSS-via-SVG-File/
CVE: CVE-2021-28060
Published: 2021-04-14
Description: A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://fatihhcelik.blogspot.com/2020/12/group-office-crm-ssrf.html; https://fatihhcelik.github.io/posts/Group-Office-CRM-SSRF/; https://fatihhcelik.blogspot.com/2020/12/group-office-crm-ssrf.html
CVE: CVE-2021-28825
Published: 2021-04-14
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition: versions 1.3.0 and below and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition: versions 1.3.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-14-2021-tibco-messaging-2021-28825; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28826
Published: 2021-04-14
Description: The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition: versions 1.3.0 and below and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition: versions 1.3.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-14-2021-tibco-messaging-2021-28826; http://www.tibco.com/services/support/advisories
CVE: CVE-2021-28855
Published: 2021-04-14
Description: In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://fatihhcelik.github.io/posts/NULL-Pointer-Dereference-Deark/; https://github.com/fuzzing2026/CVE-PoCs/tree/main/deark-CVE-2021-28855; https://github.com/jsummers/deark/commit/287f5ac31dfdc074669182f51ece637706070eeb
CVE: CVE-2021-28856
Published: 2021-04-14
Description: In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://fatihhcelik.github.io/posts/Division-By-Zero-Deark/; https://github.com/fuzzing2026/CVE-PoCs/tree/main/deark-CVE-2021-28856; https://github.com/jsummers/deark/commit/62acb7753b0e3c0d3ab3c15057b0a[PII_REDACTED]4
CVE: CVE-2020-28124
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/418sec/huntr/tree/staging/bounties/packagist/lavalite/cms/3; https://github.com/418sec/huntr/tree/staging/bounties/packagist/lavalite/cms/3
CVE: CVE-2020-35660
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/monicahq/monica/pull/4451; https://github.com/monicahq/monica/releases/tag/v2.19.1; https://www.huntr.dev/bounties/1-other-monica/
CVE: CVE-2021-26030
Published: 2021-04-14
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-escape-xss-in-logo-parameter-error-pages.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-escape-xss-in-logo-parameter-error-pages.html
CVE: CVE-2021-26031
Published: 2021-04-14
Description: An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
CVSS Score: 5.3 (MEDIUM)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-inadequate-filters-on-module-layout-settings.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-inadequate-filters-on-module-layout-settings.html
CVE: CVE-2021-27710
Published: 2021-04-14
Description: Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "ip" parameter is directly passed to the attacker, allowing them to control the "ip" field to attack the OS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://hackmd.io/Hy3oVgtcQiuqAtv9FdylHw; https://hackmd.io/KjXzQdjDRjOuRjoZZXQo_A; https://hackmd.io/Hy3oVgtcQiuqAtv9FdylHw
CVE: CVE-2021-28484
Published: 2021-04-14
Description: An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/Yubico/yubihsm-connector/releases; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7Q2KGXSPQEEONAWMFZRVH2TXWX3QPCQ/; https://www.yubico.com/support/security-advisories/ysa-2021-02/
CVE: CVE-2021-29654
Published: 2021-04-14
Description: AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://www.synacktiv.com/sites/default/files/2021-04/WP_AjaxSearchPro_Vulnerability.pdf; https://www.synacktiv.com/sites/default/files/2021-04/WP_AjaxSearchPro_Vulnerability.pdf
CVE: CVE-2021-30459
Published: 2021-04-14
Description: A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jazzband/django-debug-toolbar/releases; https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj; https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
CVE: CVE-2021-3017
Published: 2021-04-14
Description: The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.
CVSS Score: 7.5 (HIGH)
References: https://pastebin.com/cTYTf0Yn; https://www.intelbras.com/pt-br/ajuda-download/faq/roteador-wireless-veloz-wrn-342; https://pastebin.com/cTYTf0Yn
CVE: CVE-2021-28048
Published: 2021-04-14
Description: An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://devolutions.net/security/advisories/DEVO-2021-0004; https://devolutions.net/security/advisories/DEVO-2021-0004
CVE: CVE-2021-28157
Published: 2021-04-14
Description: An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://devolutions.net/security/advisories/DEVO-2021-0004; https://devolutions.net/security/advisories/DEVO-2021-0004
CVE: CVE-2021-29449
Published: 2021-04-14
Description: Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-78
References: https://github.com/pi-hole/pi-hole/security/advisories/GHSA-3597-244c-wrpj; https://github.com/pi-hole/pi-hole/security/advisories/GHSA-3597-244c-wrpj; http://packetstormsecurity.com/files/163715/Pi-Hole-Remove-Commands-Linux-Privilege-Escalation.html
CVE: CVE-2021-27180
Published: 2021-04-14
Description: An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chudyPB/MDaemon-Advisories; https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/; https://github.com/chudyPB/MDaemon-Advisories
CVE: CVE-2021-27181
Published: 2021-04-14
Description: An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/chudyPB/MDaemon-Advisories; https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/; https://github.com/chudyPB/MDaemon-Advisories
CVE: CVE-2021-27182
Published: 2021-04-14
Description: An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/chudyPB/MDaemon-Advisories; https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/; https://github.com/chudyPB/MDaemon-Advisories
CVE: CVE-2021-27183
Published: 2021-04-14
Description: An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-610
References: https://github.com/chudyPB/MDaemon-Advisories; https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/; https://github.com/chudyPB/MDaemon-Advisories
CVE: CVE-2020-36288
Published: 2021-04-15
Description: The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72115; https://jira.atlassian.com/browse/JRASERVER-72115
CVE: CVE-2021-26075
Published: 2021-04-15
Description: The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an information disclosure vulnerability in the error message when presented with an invalid filename.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-72316; https://jira.atlassian.com/browse/JRASERVER-72316
CVE: CVE-2021-26076
Published: 2021-04-15
Description: The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.
CVSS Score: 3.7 (LOW)
References: https://jira.atlassian.com/browse/JRASERVER-72252; https://jira.atlassian.com/browse/JRASERVER-72252
CVE: CVE-2021-30477
Published: 2021-04-15
Description: An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.
CVSS Score: 4.3 (MEDIUM)
References: https://blog.zulip.com/2021/04/14/zulip-server-3-4/; https://blog.zulip.com/2021/04/14/zulip-server-3-4/
CVE: CVE-2021-30478
Published: 2021-04-15
Description: An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://blog.zulip.com/2021/04/14/zulip-server-3-4/; https://blog.zulip.com/2021/04/14/zulip-server-3-4/
CVE: CVE-2021-30479
Published: 2021-04-15
Description: An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://blog.zulip.com/2021/04/14/zulip-server-3-4/; https://blog.zulip.com/2021/04/14/zulip-server-3-4/
CVE: CVE-2021-30487
Published: 2021-04-15
Description: In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
CVSS Score: 2.7 (LOW)
References: https://blog.zulip.com/2021/04/14/zulip-server-3-4/; https://blog.zulip.com/2021/04/14/zulip-server-3-4/
CVE: CVE-2020-7269
Published: 2021-04-15
Description: Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deployed as recommended with no direct access from the Internet to them.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10336; https://kc.mcafee.com/corporate/index?page=content&id=SB10336
CVE: CVE-2020-7270
Published: 2021-04-15
Description: Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deployed as recommended with no direct access from the Internet to them.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10336; https://kc.mcafee.com/corporate/index?page=content&id=SB10336
CVE: CVE-2020-7308
Published: 2021-04-15
Description: Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining control of an intermediate DNS server or altering the network DNS configuration, it is possible for an attacker to intercept requests and send their own responses.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10354; https://kc.mcafee.com/corporate/index?page=content&id=SB10354
CVE: CVE-2021-23884
Published: 2021-04-15
Description: Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read only user used to retrieve log files for analysis in CSR.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10353; https://kc.mcafee.com/corporate/index?page=content&id=SB10353
CVE: CVE-2021-23886
Published: 2021-04-15
Description: Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a BSoD through suspending a process, modifying the processes memory and restarting it. This is triggered by the hdlphook driver reading invalid memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10354; https://kc.mcafee.com/corporate/index?page=content&id=SB10357; https://kc.mcafee.com/corporate/index?page=content&id=SB10354
CVE: CVE-2021-23887
Published: 2021-04-15
Description: Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10354; https://kc.mcafee.com/corporate/index?page=content&id=SB10357; https://kc.mcafee.com/corporate/index?page=content&id=SB10354
CVE: CVE-2021-27850
Published: 2021-04-15
Description: A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2021/04/15/1; https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-27129
Published: 2021-04-15
Description: CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/161080/CASAP-Automated-Enrollment-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49470; https://packetstormsecurity.com/files/161080/CASAP-Automated-Enrollment-System-1.0-Cross-Site-Scripting.html