deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15995
Published: 2020-11-03
Description: Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html; https://crbug.com/1132111; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
CVE: CVE-2020-15996
Published: 2020-11-03
Description: Use after free in passwords in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html; https://crbug.com/1133635; https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
CVE: CVE-2020-15997
Published: 2020-11-03
Description: Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html; https://crbug.com/1133668; https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
CVE: CVE-2020-15998
Published: 2020-11-03
Description: Use after free in USB in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html; https://crbug.com/1135857; https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
CVE: CVE-2020-15999
Published: 2020-11-03
Description: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://seclists.org/fulldisclosure/2020/Nov/33; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html
CVE: CVE-2020-16000
Published: 2020-11-03
Description: Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html; https://crbug.com/1125337
CVE: CVE-2020-16001
Published: 2020-11-03
Description: Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html; https://crbug.com/1135018
CVE: CVE-2020-16002
Published: 2020-11-03
Description: Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html; https://crbug.com/1137630
CVE: CVE-2020-16003
Published: 2020-11-03
Description: Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html; https://crbug.com/1134960
CVE: CVE-2020-16004
Published: 2020-11-03
Description: Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
CVE: CVE-2020-16005
Published: 2020-11-03
Description: Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-755, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
CVE: CVE-2020-16006
Published: 2020-11-03
Description: Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
CVE: CVE-2020-16007
Published: 2020-11-03
Description: Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
CVE: CVE-2020-16008
Published: 2020-11-03
Description: Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
CVE: CVE-2020-16009
Published: 2020-11-03
Description: Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-843, CWE-787, CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html
CVE: CVE-2020-16010
Published: 2020-11-03
Description: Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-122
References: https://chromereleases.googleblog.com/2020/11/chrome-for-android-update.html; https://crbug.com/1144368; https://chromereleases.googleblog.com/2020/11/chrome-for-android-update.html
CVE: CVE-2020-16011
Published: 2020-11-03
Description: Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html; http://packetstormsecurity.com/files/159975/Chrome-ConvertToJavaBitmap-Heap-Buffer-Overflow.html
CVE: CVE-2020-6557
Published: 2020-11-03
Description: Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html; https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html; https://crbug.com/1083278
CVE: CVE-2019-4349
Published: 2020-11-03
Description: IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the confidentiality and integrity of the service. IBM X-Force ID: 161486
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161486; https://www.ibm.com/support/pages/node/6358059; https://exchange.xforce.ibmcloud.com/vulnerabilities/161486
CVE: CVE-2020-4649
Published: 2020-11-03
Description: IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186022; https://www.ibm.com/support/pages/node/6356539; https://exchange.xforce.ibmcloud.com/vulnerabilities/186022
CVE: CVE-2020-4785
Published: 2020-11-03
Description: IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 189219.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189219; https://www.ibm.com/support/pages/node/6357899; https://exchange.xforce.ibmcloud.com/vulnerabilities/189219
CVE: CVE-2020-26210
Published: 2020-11-03
Description: In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://bookstackapp.com/blog/beta-release-v0-30-4/; https://github.com/BookStackApp/BookStack/commit/349162ea139556b2d25e09e155cec84e21cc9227; https://github.com/BookStackApp/BookStack/releases/tag/v0.30.4
CVE: CVE-2020-1908
Published: 2020-11-03
Description: Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-285, CWE-552
References: https://www.whatsapp.com/security/advisories/2020/; https://www.whatsapp.com/security/advisories/2020/
CVE: CVE-2020-1909
Published: 2020-11-03
Description: A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://www.whatsapp.com/security/advisories/2020/; https://www.whatsapp.com/security/advisories/2020/
CVE: CVE-2020-26211
Published: 2020-11-03
Description: In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://github.com/BookStackApp/BookStack/commit/bbd1384acbe7e52c21f89af69f2dc391c95dbf54; https://github.com/BookStackApp/BookStack/releases/tag/v0.30.4; https://github.com/BookStackApp/BookStack/security/advisories/GHSA-r2cf-8778-3jgp
CVE: CVE-2020-27346
Published: 2020-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-2299
Published: 2020-11-04
Description: Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2020/11/04/6; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2117; http://www.openwall.com/lists/oss-security/2020/11/04/6
CVE: CVE-2020-2300
Published: 2020-11-04
Description: Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2020/11/04/6; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2099; http://www.openwall.com/lists/oss-security/2020/11/04/6
CVE: CVE-2020-2301
Published: 2020-11-04
Description: Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
CVSS Score: 9.8 (CRITICAL)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123
CVE: CVE-2020-2302
Published: 2020-11-04
Description: A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1999; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1999
CVE: CVE-2020-2303
Published: 2020-11-04
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/11/04/6; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2126; http://www.openwall.com/lists/oss-security/2020/11/04/6
CVE: CVE-2020-2304
Published: 2020-11-04
Description: Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2020/11/04/6; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145; http://www.openwall.com/lists/oss-security/2020/11/04/6
CVE: CVE-2020-2305
Published: 2020-11-04
Description: Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
CVE: CVE-2020-2306
Published: 2020-11-04
Description: A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
CVE: CVE-2020-2307
Published: 2020-11-04
Description: Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
CVE: CVE-2020-2308
Published: 2020-11-04
Description: A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2102; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2102
CVE: CVE-2020-2309
Published: 2020-11-04
Description: A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
CVE: CVE-2020-2310
Published: 2020-11-04
Description: Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1943; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1943
CVE: CVE-2020-2311
Published: 2020-11-04
Description: A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2101; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2101
CVE: CVE-2020-2312
Published: 2020-11-04
Description: Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs.
CVSS Score: 6.5 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2129; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2129
CVE: CVE-2020-2313
Published: 2020-11-04
Description: A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2110; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2110
CVE: CVE-2020-2314
Published: 2020-11-04
Description: Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2058; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2058
CVE: CVE-2020-2315
Published: 2020-11-04
Description: Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 6.5 (MEDIUM)
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1900; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1900
CVE: CVE-2020-2316
Published: 2020-11-04
Description: Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1907; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1907
CVE: CVE-2020-2317
Published: 2020-11-04
Description: Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1918; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1918
CVE: CVE-2020-2318
Published: 2020-11-04
Description: Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2085; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2085
CVE: CVE-2020-2319
Published: 2020-11-04
Description: Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2084; https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2084
CVE: CVE-2020-22275
Published: 2020-11-04
Description: Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: http://uploadboy.com/ty0715vdcii6/886/mp4; https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22275.pdf; https://filebin.net/30ceikgukh268yyj
CVE: CVE-2020-22276
Published: 2020-11-04
Description: WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: http://uploadboy.com/tvvs4p2gf03m/887/mp4; https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22276.pdf; https://filebin.net/khncr59vyfztn6wj
CVE: CVE-2020-22277
Published: 2020-11-04
Description: Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22277.pdf; https://mega.nz/file/bSQnlS4R#UY_ozLkvXgXFKzqtTRKeB9RXGi6aEQF3X6eKXdSiBt0; https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically%2Cis%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20.