deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24362
Published: 2021-08-16
Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/57823dcb-2149-47f7-aae2-d9f04dce851a; https://wpscan.com/vulnerability/57823dcb-2149-47f7-aae2-d9f04dce851a
CVE: CVE-2021-24363
Published: 2021-08-16
Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/1628935f-1d7d-4609-b7a9-e5526499c974; https://wpscan.com/vulnerability/1628935f-1d7d-4609-b7a9-e5526499c974
CVE: CVE-2021-24380
Published: 2021-08-16
Description: The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a[PII_REDACTED]39000; https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a[PII_REDACTED]39000
CVE: CVE-2021-24410
Published: 2021-08-16
Description: The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the settings, as well as add malicious verses containing JavaScript code in them, leading to Stored XSS issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-352
References: https://wpscan.com/vulnerability/b47ea36e-f37c-4745-b750-31f5b91f543f; https://wpscan.com/vulnerability/b47ea36e-f37c-4745-b750-31f5b91f543f
CVE: CVE-2021-24411
Published: 2021-08-16
Description: The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24; https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24
CVE: CVE-2021-24445
Published: 2021-08-16
Description: The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d60634a3-ca39-43be-893b-ff9ba625360f; https://wpscan.com/vulnerability/d60634a3-ca39-43be-893b-ff9ba625360f
CVE: CVE-2021-24466
Published: 2021-08-16
Description: The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://wpscan.com/vulnerability/37c7bdbb-f27f-47d3-9886-69d2e83d7581; https://wpscan.com/vulnerability/37c7bdbb-f27f-47d3-9886-69d2e83d7581
CVE: CVE-2021-24471
Published: 2021-08-16
Description: The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2. by using style, class, rel, target, width, height, or alt parameter of youtube_thumb shortcode, or 3. by embedding a video whose title or description contains XSS payload (if API key is configured).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a8ccb09a-9f8c-448f-b2d0-9b01c3a748ac; https://wpscan.com/vulnerability/a8ccb09a-9f8c-448f-b2d0-9b01c3a748ac
CVE: CVE-2021-24512
Published: 2021-08-16
Description: The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/458a576e-a7ed-4758-a80c-cd08c370aaf4; https://wpscan.com/vulnerability/458a576e-a7ed-4758-a80c-cd08c370aaf4
CVE: CVE-2021-24518
Published: 2021-08-16
Description: The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/163472/; https://wpscan.com/vulnerability/53103cdc-a4bf-40fa-aeb1-790fc7a65f0a; https://packetstormsecurity.com/files/163472/
CVE: CVE-2021-24519
Published: 2021-08-16
Description: The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/368828f9-fdd1-4a82-8658-20e0f4c4da0c; https://wpscan.com/vulnerability/368828f9-fdd1-4a82-8658-20e0f4c4da0c
CVE: CVE-2021-24526
Published: 2021-08-16
Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/17287d8a-ba27-42dc-9370-a931ef404995; https://wpscan.com/vulnerability/17287d8a-ba27-42dc-9370-a931ef404995
CVE: CVE-2021-24527
Published: 2021-08-16
Description: The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207; https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207
CVE: CVE-2021-24534
Published: 2021-08-16
Description: The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b968b9a1-67f3-4bef-a3d3-6e8942bb6570; https://wpscan.com/vulnerability/b968b9a1-67f3-4bef-a3d3-6e8942bb6570
CVE: CVE-2021-24535
Published: 2021-08-16
Description: The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://wpscan.com/vulnerability/351de889-9c0a-4637-bd06-0e1fe1d7e89f; https://wpscan.com/vulnerability/351de889-9c0a-4637-bd06-0e1fe1d7e89f
CVE: CVE-2021-24536
Published: 2021-08-16
Description: The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://wpscan.com/vulnerability/e1ca9978-a44d-4717-b963-acaf56258fc9; https://wpscan.com/vulnerability/e1ca9978-a44d-4717-b963-acaf56258fc9
CVE: CVE-2021-24538
Published: 2021-08-16
Description: The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f9911a43-0f4c-403f-9fca-7822eb693317; https://wpscan.com/vulnerability/f9911a43-0f4c-403f-9fca-7822eb693317
CVE: CVE-2021-24540
Published: 2021-08-16
Description: The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/67910e5d-ea93-418b-af81-c50d0e05d213; https://wpscan.com/vulnerability/67910e5d-ea93-418b-af81-c50d0e05d213
CVE: CVE-2021-24541
Published: 2021-08-16
Description: The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/e6602369-87f4-4454-8298-89cc69f8375c; https://wpscan.com/vulnerability/e6602369-87f4-4454-8298-89cc69f8375c
CVE: CVE-2021-24548
Published: 2021-08-16
Description: The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/10660c95-d366-4152-9ce8-b57c57a2ec6c; https://wpscan.com/vulnerability/10660c95-d366-4152-9ce8-b57c57a2ec6c
CVE: CVE-2021-35392
Published: 2021-08-16
Description: Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain; https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en; https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
CVE: CVE-2021-35393
Published: 2021-08-16
Description: Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain; https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en; https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
CVE: CVE-2021-35394
Published: 2021-08-16
Description: Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain; https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en; https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
CVE: CVE-2021-35395
Published: 2021-08-16
Description: Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.
CVSS Score: 9.8 (CRITICAL)
References: https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain; https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en; https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf
CVE: CVE-2021-38607
Published: 2021-08-16
Description: Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://crocoblock.com/changelog/?plugin=jet-engine; https://crocoblock.com/plugins/jetengine/; https://crocoblock.com/changelog/?plugin=jet-engine
CVE: CVE-2021-38751
Published: 2021-08-16
Description: A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-116
References: https://github.com/exponentcms/exponent-cms/issues/1544; https://github.com/exponentcms/exponent-cms/issues/1544
CVE: CVE-2021-38752
Published: 2021-08-16
Description: A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrarily inject code in the search bar.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dumpling-soup/Online-Catering-Reservation/blob/main/README.md; https://github.com/dumpling-soup/Online-Catering-Reservation/blob/main/README.md
CVE: CVE-2021-38753
Published: 2021-08-16
Description: An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access to the server hosting the web app.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/dumpling-soup/Simple-Image-Gallery-Web-App/blob/main/README.md; https://github.com/dumpling-soup/Simple-Image-Gallery-Web-App/blob/main/README.md
CVE: CVE-2021-38754
Published: 2021-08-16
Description: SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/kishan0725/Hospital-Management-System/issues/7; https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38754; https://streamable.com/y9qy4m
CVE: CVE-2021-38755
Published: 2021-08-16
Description: Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/kishan0725/Hospital-Management-System/issues/5; https://github.com/kishan0725/Hospital-Management-System/issues/5
CVE: CVE-2021-38756
Published: 2021-08-16
Description: Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kishan0725/Hospital-Management-System/issues/4; https://github.com/kishan0725/Hospital-Management-System/issues/4
CVE: CVE-2021-38757
Published: 2021-08-16
Description: Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163869/Hospital-Management-System-Cross-Site-Scripting.html; https://github.com/kishan0725/Hospital-Management-System/issues/6; http://packetstormsecurity.com/files/163869/Hospital-Management-System-Cross-Site-Scripting.html
CVE: CVE-2021-38758
Published: 2021-08-16
Description: Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://attackerkb.com/topics/XuEb81tsid/online-catering-reservation-dt-food-catering-by-oretnom23-v1-0-sql-injection---login; https://github.com/dumpling-soup/Online-Catering-Reservation-DT/blob/main/README.md; https://github.com/nu11secur1ty/CVE-mitre/blob/main/CVE-2021-38758/README.MD
CVE: CVE-2020-18698
Published: 2021-08-16
Description: Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://cwe.mitre.org/data/definitions/307.html; https://github.com/TaleLin/lin-cms-flask/issues/27; https://cwe.mitre.org/data/definitions/307.html
CVE: CVE-2020-18699
Published: 2021-08-16
Description: Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/TaleLin/lin-cms-flask/issues/28; https://github.com/TaleLin/lin-cms-flask/issues/28
CVE: CVE-2020-18701
Published: 2021-08-16
Description: Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://cwe.mitre.org/data/definitions/613.html; https://github.com/TaleLin/lin-cms-flask/issues/30; https://cwe.mitre.org/data/definitions/613.html
CVE: CVE-2020-18702
Published: 2021-08-16
Description: Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rochacbruno/quokka/issues/675; https://github.com/rochacbruno/quokka/issues/675
CVE: CVE-2020-18703
Published: 2021-08-16
Description: XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/rochacbruno/quokka/issues/676; https://github.com/rochacbruno/quokka/issues/676
CVE: CVE-2020-18704
Published: 2021-08-16
Description: Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/fusionbox/django-widgy/issues/387; https://github.com/fusionbox/django-widgy/issues/387
CVE: CVE-2020-18705
Published: 2021-08-16
Description: XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/rochacbruno/quokka/issues/676; https://github.com/rochacbruno/quokka/issues/676
CVE: CVE-2021-0114
Published: 2021-08-16
Description: Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1188
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00527.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-22931
Published: 2021-08-16
Description: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-170, CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1178337; https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
CVE: CVE-2021-22932
Published: 2021-08-16
Description: An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option to become disabled if it had previously been enabled. Customers are only affected by this issue if they previously selected “Enable Encryption” in the ShareFile configuration page and did not re-select this setting after running the CTX269106 mitigation tool. ShareFile customers who have not run the CTX269106 mitigation tool or who re-selected “Enable Encryption” immediately after running the tool are unaffected by this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-311
References: https://support.citrix.com/article/CTX322787; https://support.citrix.com/article/CTX322787
CVE: CVE-2021-22933
Published: 2021-08-16
Description: A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858/?kA23Z000000L6oySAC