deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29044
Published: 2021-05-17
Description: Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548; http://liferay.com
CVE: CVE-2021-29045
Published: 2021-05-17
Description: Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484; http://liferay.com
CVE: CVE-2021-29046
Published: 2021-05-17
Description: Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501; http://liferay.com
CVE: CVE-2021-29053
Published: 2021-05-17
Description: Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225; http://liferay.com
CVE: CVE-2007-5967
Published: 2021-05-17
Description: A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://bugzilla-dev.allizom.org/show_bug.cgi?id=406724; https://bugzilla-dev.allizom.org/show_bug.cgi?id=406724
CVE: CVE-2021-29048
Published: 2021-05-17
Description: Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601; http://liferay.com
CVE: CVE-2021-29051
Published: 2021-05-17
Description: Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580; http://liferay.com
CVE: CVE-2021-29052
Published: 2021-05-17
Description: The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159; http://liferay.com
CVE: CVE-2021-3483
Published: 2021-05-17
Description: A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2021/04/07/1; https://bugzilla.redhat.com/show_bug.cgi?id=1948045; https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE: CVE-2021-27342
Published: 2021-05-17
Description: An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://blog.whtaguy.com/2021/05/d-link-router-cve-2021-27342.html; https://github.com/guywhataguy/D-Link-CVE-2021-27342-exploit/blob/main/dlink-telnet-exploit-CVE-2021-27342.py; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10225
CVE: CVE-2021-31727
Published: 2021-05-17
Description: Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x80002010 and send these IOCTL's to escalate privileges by overwriting the boot sector or overwriting critical code in the pagefile.
CVSS Score: 7.8 (HIGH)
References: https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31727.md; https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31727.md
CVE: CVE-2021-31728
Published: 2021-05-17
Description: Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.
CVSS Score: 7.8 (HIGH)
References: https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md; https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md
CVE: CVE-2021-32402
Published: 2021-05-17
Description: Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.youtube.com/watch?v=X2cU9MBN2Ys; https://www.youtube.com/watch?v=X2cU9MBN2Ys
CVE: CVE-2021-32403
Published: 2021-05-17
Description: Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and unsafe inputs and modules.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/163023/Intelbras-Router-RF-301K-Cross-Site-Request-Forgery.html; https://www.youtube.com/watch?v=1Ed-2xBFG3M; http://packetstormsecurity.com/files/163023/Intelbras-Router-RF-301K-Cross-Site-Request-Forgery.html
CVE: CVE-2021-27734
Published: 2021-05-17
Description: Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=12914&mediaformatid=50063&destinationid=10016; https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=12914&mediaformatid=50063&destinationid=10016
CVE: CVE-2019-14827
Published: 2021-05-17
Description: A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284; https://moodle.org/mod/forum/discuss.php?d=391030; https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284
CVE: CVE-2020-13667
Published: 2021-05-17
Description: Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://www.drupal.org/sa-core-2020-008; https://www.drupal.org/sa-core-2020-008
CVE: CVE-2020-4669
Published: 2021-05-17
Description: IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 184600.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186400; https://www.ibm.com/support/pages/node/6436821; https://exchange.xforce.ibmcloud.com/vulnerabilities/186400
CVE: CVE-2020-4670
Published: 2021-05-17
Description: IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected by password authentication. A remote attacker can exploit this to gain unauthorized access to the server. IBM X-Force ID: 186401.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186401; https://www.ibm.com/support/pages/node/6436821; https://exchange.xforce.ibmcloud.com/vulnerabilities/186401
CVE: CVE-2021-24288
Published: 2021-05-17
Description: When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/[PII_REDACTED]-9ed4-145d8dfbca97; https://wpscan.com/vulnerability/[PII_REDACTED]-9ed4-145d8dfbca97
CVE: CVE-2021-24289
Published: 2021-05-17
Description: There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62; https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/; https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62
CVE: CVE-2021-24290
Published: 2021-05-17
Description: There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719; https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin; https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719
CVE: CVE-2021-24292
Published: 2021-05-17
Description: The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0f20e098-8106-451f-9448-d35a79f03077; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/0f20e098-8106-451f-9448-d35a79f03077
CVE: CVE-2021-24295
Published: 2021-05-17
Description: It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b; https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/; https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b
CVE: CVE-2021-24299
Published: 2021-05-17
Description: The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/162756/WordPress-ReDi-Restaurant-Reservation-21.0307-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/fd6ce00b-8c5f-4180-b648-f47b37303670; http://packetstormsecurity.com/files/162756/WordPress-ReDi-Restaurant-Reservation-21.0307-Cross-Site-Scripting.html
CVE: CVE-2021-24314
Published: 2021-05-17
Description: The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://m0ze.ru/vulnerability/%5B2021-03-24%5D-%5BWordPress%5D-%5BCWE-89%5D-Goto-WordPress-Theme-v2.0.txt; https://wpscan.com/vulnerability/1cc6dc17-b019-49dd-8149-c8bba165eb30; https://m0ze.ru/vulnerability/%5B2021-03-24%5D-%5BWordPress%5D-%5BCWE-89%5D-Goto-WordPress-Theme-v2.0.txt
CVE: CVE-2021-24315
Published: 2021-05-17
Description: The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt; https://wpscan.com/vulnerability/006b37c9-641c-4676-a315-9b6053e001d2; https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt
CVE: CVE-2021-24323
Published: 2021-05-17
Description: When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010; https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010
CVE: CVE-2021-24324
Published: 2021-05-17
Description: The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/63a24890-3735-4016-b4b7-4b070a842664; https://wpscan.com/vulnerability/63a24890-3735-4016-b4b7-4b070a842664
CVE: CVE-2021-24325
Published: 2021-05-17
Description: The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/96e9a7fd-9ab8-478e-9420-4bca2a0b23a1; https://wpscan.com/vulnerability/96e9a7fd-9ab8-478e-9420-4bca2a0b23a1
CVE: CVE-2021-24326
Published: 2021-05-17
Description: The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/63d6ca03-e0df-40db-9839-531c13619094; https://wpscan.com/vulnerability/63d6ca03-e0df-40db-9839-531c13619094
CVE: CVE-2021-24327
Published: 2021-05-17
Description: The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ca8068f7-dcf0-44fd-841d-d02987220d79; https://wpscan.com/vulnerability/ca8068f7-dcf0-44fd-841d-d02987220d79
CVE: CVE-2021-25264
Published: 2021-05-17
Description: In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges.
CVSS Score: 6.7 (MEDIUM)
References: https://community.sophos.com/b/security-blog; https://community.sophos.com/b/security-blog/posts/resolved-lpe-in-endpoint-for-macos-cve-2021-25264; https://community.sophos.com/b/security-blog
CVE: CVE-2021-29747
Published: 2021-05-17
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain highly sensitive information due to a vulnerability in the authentication mechanism. IBM X-Force ID: 201775.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201775; https://www.ibm.com/support/pages/node/6453437; https://exchange.xforce.ibmcloud.com/vulnerabilities/201775
CVE: CVE-2021-32453
Published: 2021-05-17
Description: SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network, to access via HTTP to the internal configuration database of the device without any authentication. An attacker could exploit this vulnerability in order to obtain information about the device´s configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/sitel-capprx-information-exposure; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/sitel-capprx-information-exposure
CVE: CVE-2021-32455
Published: 2021-05-17
Description: SITEL CAP/PRX firmware version 5.2.01, allows an attacker with access to the device´s network to cause a denial of service condition on the device. An attacker could exploit this vulnerability by sending HTTP requests massively.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.incibe-cert.es/en/early-warning/ics-advisories/sitel-capprx-vulnerable-denial-service-attack; https://www.incibe-cert.es/en/early-warning/ics-advisories/sitel-capprx-vulnerable-denial-service-attack
CVE: CVE-2021-33041
Published: 2021-05-17
Description: vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yoshuawuyts/vmd/issues/137; https://github.com/yoshuawuyts/vmd/issues/137
CVE: CVE-2021-3524
Published: 2021-05-17
Description: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://bugzilla.redhat.com/show_bug.cgi?id=1951674; https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE: CVE-2020-21813
Published: 2021-05-17
Description: A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://gnu.com; http://libredwg.com; https://github.com/LibreDWG/libredwg/issues/182#issuecomment-572890969
CVE: CVE-2021-23384
Published: 2021-05-17
Description: The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::removeTrailingSlashes(), as the web server uses relative URLs instead of absolute URLs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/vgno/koa-remove-trailing-slashes/blame/6a01ba8fd019bd3ece44879c553037ad96ba7d47/index.js%23L31; https://snyk.io/vuln/SNYK-JS-KOAREMOVETRAILINGSLASHES-1085708; https://github.com/vgno/koa-remove-trailing-slashes/blame/6a01ba8fd019bd3ece44879c553037ad96ba7d47/index.js%23L31
CVE: CVE-2021-32454
Published: 2021-05-17
Description: SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the administrators of the device without access.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.incibe-cert.es/en/early-warning/ics-advisories/sitel-capprx-hardcoded-credentials; https://www.incibe-cert.es/en/early-warning/ics-advisories/sitel-capprx-hardcoded-credentials