deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38570
Published: 2021-08-11
Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-59
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-38571
Published: 2021-08-11
Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-38572
Published: 2021-08-11
Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.
CVSS Score: 9.8 (CRITICAL)
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-38573
Published: 2021-08-11
Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.
CVSS Score: 9.8 (CRITICAL)
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-38574
Published: 2021-08-11
Description: An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-36770
Published: 2021-08-11
Description: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9; https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB/
CVE: CVE-2021-37626
Published: 2021-08-11
Description: Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html; https://github.com/contao/contao/security/advisories/GHSA-r6mv-ppjc-4hgr; https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html
CVE: CVE-2021-37627
Published: 2021-08-11
Description: Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form generator or disable the login for untrusted back end users.
CVSS Score: 8.0 (HIGH)
CWE: CWE-269, CWE-269
References: https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html; https://github.com/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6m; https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html
CVE: CVE-2021-37696
Published: 2021-08-11
Description: tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific MassDM message. Issue is patched in commit 92325be650a6c17940cc[PII_REDACTED]3ed95dbbe1. All users are advised to update to the current commit. As a workaround users may unload the MassDM cog or globally disable the `[p]massdm` command.
CVSS Score: 7.1 (HIGH)
CWE: CWE-306
References: https://github.com/tmercswims/tmerc-cogs/commit/92325be650a6c17940cc5; https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-ffhm-9c8j-wx9h; https://github.com/tmercswims/tmerc-cogs/commit/92325be650a6c17940cc5
CVE: CVE-2021-37697
Published: 2021-08-11
Description: tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific membership event message. Issue is patched in commit d63c49b4cfc30c795336e4fff08cba3795e0fcc0. As a workaround users may unload the Welcome cog.
CVSS Score: 7.1 (HIGH)
CWE: CWE-306
References: https://github.com/tmercswims/tmerc-cogs/commit/d63c49b4cfc30c795336e4fff08cba3795e0fcc0; https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-77xv-8c2x-j96j; https://github.com/tmercswims/tmerc-cogs/commit/d63c49b4cfc30c795336e4fff08cba3795e0fcc0
CVE: CVE-2021-38584
Published: 2021-08-11
Description: The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://docs.cpanel.net/changelogs/98-change-log/; https://docs.cpanel.net/changelogs/98-change-log/
CVE: CVE-2021-38585
Published: 2021-08-11
Description: The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://docs.cpanel.net/changelogs/98-change-log/; https://docs.cpanel.net/changelogs/98-change-log/
CVE: CVE-2021-38586
Published: 2021-08-11
Description: In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
CVSS Score: 4.4 (MEDIUM)
References: https://docs.cpanel.net/changelogs/98-change-log/; https://docs.cpanel.net/changelogs/98-change-log/
CVE: CVE-2021-38587
Published: 2021-08-11
Description: In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://docs.cpanel.net/changelogs/96-change-log/; https://docs.cpanel.net/changelogs/96-change-log/
CVE: CVE-2021-38588
Published: 2021-08-11
Description: In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: https://docs.cpanel.net/changelogs/96-change-log/; https://docs.cpanel.net/changelogs/96-change-log/
CVE: CVE-2021-38589
Published: 2021-08-11
Description: In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
CVSS Score: 8.1 (HIGH)
References: https://docs.cpanel.net/changelogs/96-change-log/; https://docs.cpanel.net/changelogs/96-change-log/
CVE: CVE-2021-38590
Published: 2021-08-11
Description: In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://docs.cpanel.net/changelogs/96-change-log/; https://docs.cpanel.net/changelogs/96-change-log/
CVE: CVE-2021-37699
Published: 2021-08-12
Description: Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/vercel/next.js/releases/tag/v11.1.0; https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9; https://github.com/vercel/next.js/releases/tag/v11.1.0
CVE: CVE-2021-38591
Published: 2021-08-12
Description: An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt6883. Attackers can change some of the NvRAM content by leveraging the misconfiguration of a debug command. The LG ID is LVE-SMP-210005 (August 2021).
CVSS Score: 3.3 (LOW)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2021-38592
Published: 2021-08-12
Description: Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33554; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wasm3/OSV-2021-676.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33554
CVE: CVE-2021-38593
Published: 2021-08-12
Description: Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml; https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862
CVE: CVE-2020-24576
Published: 2021-08-12
Description: Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.netskope.com; https://www.netskope.com/company/security-compliance-and-assurance/release-78-security-advisory-nskpsa2020-001; https://www.netskope.com
CVE: CVE-2021-37222
Published: 2021-08-12
Description: Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via specially crafted packets.
CVSS Score: 9.8 (CRITICAL)
References: http://hg.code.sf.net/p/rcdcap/code/rev/0af05606c55b#l2.10; https://www.openhub.net/p/rcdcap; http://hg.code.sf.net/p/rcdcap/code/rev/0af05606c55b#l2.10
CVE: CVE-2020-28165
Published: 2021-08-12
Description: The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.zentao.net/dynamic/zentaopms12.4.2-80263.html; https://www.zentao.net/dynamic/zentaopms12.4.2-80263.html
CVE: CVE-2021-37841
Published: 2021-08-12
Description: Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read, write and possibly even execute code inside the containers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://docs.docker.com/docker-for-windows/release-notes/; https://docs.docker.com/docker-for-windows/release-notes/
CVE: CVE-2021-38086
Published: 2021-08-12
Description: Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://kb.acronis.com/content/68564; https://kb.acronis.com/content/68564
CVE: CVE-2021-38087
Published: 2021-08-12
Description: Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.acronis.com/content/68564; https://kb.acronis.com/content/68564
CVE: CVE-2021-38088
Published: 2021-08-12
Description: Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking.
CVSS Score: 7.8 (HIGH)
References: https://kb.acronis.com/content/68564; https://kb.acronis.com/content/68564
CVE: CVE-2020-20975
Published: 2021-08-12
Description: In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.csdn.net/qq_41770175/article/details/93486383; https://blog.csdn.net/qq_41770175/article/details/93486383
CVE: CVE-2020-20977
Published: 2021-08-12
Description: A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yxcmf/ukcms/issues/6; https://github.com/yxcmf/ukcms/issues/6
CVE: CVE-2020-20979
Published: 2021-08-12
Description: An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/0xyu/PHP_Learning/issues/2; https://github.com/0xyu/PHP_Learning/issues/2
CVE: CVE-2020-20981
Published: 2021-08-12
Description: A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/yao123123123/CVE/issues/1; https://github.com/yao123123123/CVE/issues/1
CVE: CVE-2021-20314
Published: 2021-08-12
Description: Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1993070; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMSFT2NJDZ7PATRZSQPAOGSE7JD6ELOB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJRHPE5OSCPTNA3ZZ4ORDHT4JQH3Y4/
CVE: CVE-2021-27790
Published: 2021-08-12
Description: The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string function to process user input. Authenticated attackers can abuse this vulnerability to exploit stack-based buffer overflows, allowing execution of arbitrary code as the root user account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1492; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-27791
Published: 2021-08-12
Description: The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a malformed authentication header from the client, resulting in reading memory addresses outside the intended range. An unauthenticated attacker could discover a request, which could bypass the authentication process.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1491; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-27792
Published: 2021-08-12
Description: The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properly handle malformed user input, resulting in a service crash. An authenticated attacker could use this weakness to cause the FOS HTTP application handler to crash, requiring a reboot.
CVSS Score: 7.8 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1490; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1492
CVE: CVE-2021-27793
Published: 2021-08-12
Description: ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS before Brocade Fabric OS v8.2.3a and after v8.2.0 could cause a user with a valid account to be unable to log into the switch.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1553; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-27794
Published: 2021-08-12
Description: A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to Login with empty password, and invalid password through telnet, ssh and REST.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1552; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-35955
Published: 2021-08-12
Description: Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://contao.org/en/news/contao-4-9-16-and-4-11-5-are-available.html; https://github.com/contao/contao/security/advisories/GHSA-hr3h-x6gq-rqcp; https://contao.org/en/news/contao-4-9-16-and-4-11-5-are-available.html
CVE: CVE-2021-38597
Published: 2021-08-12
Description: wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-345
References: https://github.com/wolfSSL/wolfssl/commit/f93083be72a3b3d956b52a7ec13f307a27b6e093; https://www.wolfssl.com/docs/wolfssl-changelog/; https://github.com/wolfSSL/wolfssl/commit/f93083be72a3b3d956b52a7ec13f307a27b6e093
CVE: CVE-2021-20509
Published: 2021-08-12
Description: IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 198243.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198243; https://www.ibm.com/support/pages/node/6480377; https://exchange.xforce.ibmcloud.com/vulnerabilities/198243
CVE: CVE-2021-38291
Published: 2021-08-12
Description: FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html; https://security.gentoo.org/glsa/202312-14; https://trac.ffmpeg.org/ticket/9312
CVE: CVE-2021-38599
Published: 2021-08-12
Description: WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3; https://github.com/wal-g/wal-g/pull/1062; https://github.com/wal-g/wal-g/commit/cadf598e1c2a345915a21a44518c5a4d5401e2e3
CVE: CVE-2021-38604
Published: 2021-08-12
Description: In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/; https://security.gentoo.org/glsa/202208-24
CVE: CVE-2021-38606
Published: 2021-08-12
Description: reNgine through 0.5 relies on a predictable directory name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://github.com/yogeshojha/rengine/commit/158367a231335026b8dba633a76b44de290ad37c; https://github.com/yogeshojha/rengine/commit/158367a231335026b8dba633a76b44de290ad37c
CVE: CVE-2020-18445
Published: 2021-08-12
Description: Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/doublefast/yunucms; https://github.com/doublefast/yunucms/issues/8; https://github.com/doublefast/yunucms
CVE: CVE-2020-18446
Published: 2021-08-12
Description: Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the param parameter in the insertContent function in ContentModel.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/doublefast/yunucms/issues/9; https://github.com/doublefast/yunucms/issues/9
CVE: CVE-2021-32808
Published: 2021-08-12
Description: ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/ckeditor/ckeditor4/releases/tag/4.16.2; https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
CVE: CVE-2021-32809
Published: 2021-08-12
Description: ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
CVE: CVE-2020-18449
Published: 2021-08-12
Description: Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yxcmf/ukcms/issues/3; https://github.com/yxcmf/ukcms/issues/3