deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34441
Published: 2021-07-16
Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34441; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34441
CVE: CVE-2021-34442
Published: 2021-07-16
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34442; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34442
CVE: CVE-2021-34444
Published: 2021-07-16
Description: Windows DNS Server Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34444; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34444
CVE: CVE-2021-34445
Published: 2021-07-16
Description: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34445; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34445
CVE: CVE-2021-34446
Published: 2021-07-16
Description: Windows HTML Platforms Security Feature Bypass Vulnerability
CVSS Score: 8.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34446; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34446
CVE: CVE-2021-34447
Published: 2021-07-16
Description: Windows MSHTML Platform Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34447; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34447
CVE: CVE-2021-34448
Published: 2021-07-16
Description: Scripting Engine Memory Corruption Vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34448; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34448; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34448
CVE: CVE-2021-34449
Published: 2021-07-16
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34449; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34449
CVE: CVE-2021-34450
Published: 2021-07-16
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 8.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34450; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34450
CVE: CVE-2021-34451
Published: 2021-07-16
Description: Microsoft Office Online Server Spoofing Vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34451; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34451
CVE: CVE-2021-34452
Published: 2021-07-16
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34452; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34452
CVE: CVE-2021-34454
Published: 2021-07-16
Description: Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34454; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34454
CVE: CVE-2021-34455
Published: 2021-07-16
Description: Windows File History Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34455; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34455
CVE: CVE-2021-34456
Published: 2021-07-16
Description: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34456; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34456
CVE: CVE-2021-34457
Published: 2021-07-16
Description: Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34457; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34457
CVE: CVE-2021-34458
Published: 2021-07-16
Description: Windows Kernel Remote Code Execution Vulnerability
CVSS Score: 9.9 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34458; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34458
CVE: CVE-2021-34459
Published: 2021-07-16
Description: Windows AppContainer Elevation Of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34459; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34459
CVE: CVE-2021-34460
Published: 2021-07-16
Description: Storage Spaces Controller Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34460; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34460
CVE: CVE-2021-34461
Published: 2021-07-16
Description: Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34461; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34461
CVE: CVE-2021-34462
Published: 2021-07-16
Description: Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34462; https://www.zerodayinitiative.com/advisories/ZDI-21-823/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34462
CVE: CVE-2021-34464
Published: 2021-07-16
Description: Microsoft Defender Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34464; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34464
CVE: CVE-2021-34466
Published: 2021-07-16
Description: Windows Hello Security Feature Bypass Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-290
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34466; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34466
CVE: CVE-2021-34467
Published: 2021-07-16
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34467; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34467
CVE: CVE-2021-34481
Published: 2021-07-16
Description: <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p><strong>UPDATE</strong> August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see <a href="https://support.microsoft.com/help/5005652">KB5005652</a>.</p>
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34481; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34481
CVE: CVE-2021-3452
Published: 2021-07-16
Description: A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-65529; https://support.lenovo.com/us/en/product_security/LEN-65529
CVE: CVE-2021-3453
Published: 2021-07-16
Description: Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-693
References: https://support.lenovo.com/us/en/product_security/LEN-65529; https://support.lenovo.com/us/en/product_security/LEN-65529
CVE: CVE-2021-3550
Published: 2021-07-16
Description: A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/dc_197169.html; https://iknow.lenovo.com.cn/detail/dc_197169.html
CVE: CVE-2021-3614
Published: 2021-07-16
Description: A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-636
References: https://support.lenovo.com/us/en/product_security/LEN-65529; https://support.lenovo.com/us/en/product_security/LEN-65529
CVE: CVE-2019-3752
Published: 2021-07-16
Description: Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4. contain an XML External Entity(XXE) Injection vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability to cause Denial of Service or information exposure by supplying specially crafted document type definitions (DTDs) in an XML request.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.dell.com/support/security/en-us/details/537853/DSA-2019-119-Dell-EMC-Avamar-XML-External-Entity-Injection-Vulnerability; https://www.dell.com/support/security/en-us/details/537853/DSA-2019-119-Dell-EMC-Avamar-XML-External-Entity-Injection-Vulnerability
CVE: CVE-2021-36769
Published: 2021-07-17
Description: A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client.
CVSS Score: 5.3 (MEDIUM)
References: https://mtpsym.github.io; https://mtpsym.github.io
CVE: CVE-2021-32574
Published: 2021-07-17
Description: HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856; https://github.com/hashicorp/consul/releases/tag/v1.10.1; https://security.gentoo.org/glsa/202208-09
CVE: CVE-2021-36213
Published: 2021-07-17
Description: HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
CVSS Score: 7.5 (HIGH)
References: https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855; https://github.com/hashicorp/consul/releases/tag/v1.10.1; https://security.gentoo.org/glsa/202208-09
CVE: CVE-2021-33911
Published: 2021-07-17
Description: Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://www.manageengine.com/products/ad-manager/release-notes.html#7110; https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE: CVE-2021-36771
Published: 2021-07-17
Description: Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/ad-manager/release-notes.html#7110; https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE: CVE-2021-36772
Published: 2021-07-17
Description: Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/ad-manager/release-notes.html#7110; https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE: CVE-2021-36773
Published: 2021-07-18
Description: uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc; https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html; https://news.ycombinator.com/item?id=27833752
CVE: CVE-2021-33592
Published: 2021-07-19
Description: NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://cve.naver.com/detail/cve-2021-33592; https://cve.naver.com/detail/cve-2021-33592
CVE: CVE-2021-24436
Published: 2021-07-19
Description: The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/05988ebb-7378-4a3a-9d2d-30f8f58fe9ef; https://wpscan.com/vulnerability/05988ebb-7378-4a3a-9d2d-30f8f58fe9ef
CVE: CVE-2021-24447
Published: 2021-07-19
Description: The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/fb9dbcdf-4ffd-484d-9b67-283683d050fd; https://wpscan.com/vulnerability/fb9dbcdf-4ffd-484d-9b67-283683d050fd
CVE: CVE-2021-24452
Published: 2021-07-19
Description: The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3e855e09-056f-45b5-89a9-d644b7d8c9d0; https://wpscan.com/vulnerability/3e855e09-056f-45b5-89a9-d644b7d8c9d0
CVE: CVE-2021-24453
Published: 2021-07-19
Description: The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://wpscan.com/vulnerability/78575072-4e04-4a8a-baec-f313cfffe829; https://wpscan.com/vulnerability/78575072-4e04-4a8a-baec-f313cfffe829
CVE: CVE-2021-24482
Published: 2021-07-19
Description: The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-04-18%5D-%5BWordPress%5D-%5BCWE-79%5D-Related-Posts-for-WordPress-WordPress-Plugin-v2.0.4.txt; https://wpscan.com/vulnerability/2f86e418-22fd-4cb8-8de1-062b17cf20a7; https://m0ze.ru/vulnerability/%5B2021-04-18%5D-%5BWordPress%5D-%5BCWE-79%5D-Related-Posts-for-WordPress-WordPress-Plugin-v2.0.4.txt
CVE: CVE-2021-33027
Published: 2021-07-19
Description: Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331
References: https://medium.com/sylabs; https://support.sylabs.io/a/solutions/articles/[PII_REDACTED]9; https://medium.com/sylabs
CVE: CVE-2021-33501
Published: 2021-07-19
Description: Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/swordbytes/Advisories/blob/master/2021/Advisory_CVE-2021-33501.pdf; https://swordbytes.com/blog/security-advisory-overwolf-1-click-remote-code-execution-cve-2021-33501/; https://www.overwolf.com
CVE: CVE-2021-35963
Published: 2021-07-19
Description: The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25; https://www.twcert.org.tw/tw/cp-132-4923-d68e6-1.html; https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE: CVE-2021-35964
Published: 2021-07-19
Description: The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.
CVSS Score: 7.3 (HIGH)
CWE: CWE-285, CWE-287
References: https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25; https://www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html; https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE: CVE-2021-35965
Published: 2021-07-19
Description: The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-1188
References: https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25; https://www.twcert.org.tw/tw/cp-132-4925-86733-1.html; https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE: CVE-2021-35966
Published: 2021-07-19
Description: The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25; https://www.twcert.org.tw/tw/cp-132-4926-dc06b-1.html; https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE: CVE-2021-35967
Published: 2021-07-19
Description: The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25; https://www.twcert.org.tw/tw/cp-132-4927-bbf01-1.html; https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE: CVE-2021-35968
Published: 2021-07-19
Description: The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25; https://www.twcert.org.tw/tw/cp-132-4928-7e87b-1.html; https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
CVE: CVE-2021-31216
Published: 2021-07-19
Description: Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://community.siren.io/c/announcements; https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html; https://community.siren.io/c/announcements
CVE: CVE-2021-3279
Published: 2021-07-19
Description: sz.chat version 4 allows injection of web scripts and HTML in the message box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://borrachariadofael.sz.chat/webchat/conversation/6009c625415e206dc77172d3; https://www.youtube.com/watch?v=H9ttpjFVDgA; https://borrachariadofael.sz.chat/webchat/conversation/6009c625415e206dc77172d3
CVE: CVE-2021-32012
Published: 2021-07-19
Description: SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/; https://sheetjs.com/pro; https://www.npmjs.com/package/xlsx/v/0.17.0
CVE: CVE-2021-32013
Published: 2021-07-19
Description: SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/; https://sheetjs.com/pro; https://www.npmjs.com/package/xlsx/v/0.17.0
CVE: CVE-2021-32014
Published: 2021-07-19
Description: SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/; https://sheetjs.com/pro; https://www.npmjs.com/package/xlsx/v/0.17.0
CVE: CVE-2021-34817
Published: 2021-07-19
Description: A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities; https://etherpad.org/#download; https://github.com/ether/etherpad-lite/commit/a[PII_REDACTED]e20ef47a533e030f59f830486bdfa