deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3559
Published: 2021-05-24
Description: A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices (e.g., GRID driver). This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt daemon by executing the 'nodedev-list' virsh command. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1962306; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1962306
CVE: CVE-2020-25408
Published: 2021-05-24
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or make a new entry of the student, faculty, teacher, subject, scores, location, and article data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/olotieno/College-Management-System-Php/; https://nikhilkumar01.medium.com/cve-2020-25408-97eb7bcc23a6; https://github.com/olotieno/College-Management-System-Php/
CVE: CVE-2020-25409
Published: 2021-05-24
Description: Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/olotieno/College-Management-System-Php/tree/master/College-Management-System%20in%20Php_5.5/College-Management-System%20in%20Php_5.5; https://nikhilkumar01.medium.com/cve-2020-25409-5ecbe735c004; https://github.com/olotieno/College-Management-System-Php/tree/master/College-Management-System%20in%20Php_5.5/College-Management-System%20in%20Php_5.5
CVE: CVE-2020-25411
Published: 2021-05-24
Description: Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/projectworldsofficial/online-examination-systen-in-php; https://nikhilkumar01.medium.com/cve-2020-25411-a245bdf88fb5; https://github.com/projectworldsofficial/online-examination-systen-in-php
CVE: CVE-2020-26006
Published: 2021-05-24
Description: Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/projectworldsofficial/online-examination-systen-in-php/archive/master.zip; https://nikhilkumar01.medium.com/cve-2020-26006-31f847e16019; https://github.com/projectworldsofficial/online-examination-systen-in-php/archive/master.zip
CVE: CVE-2020-28900
Published: 2021-05-24
Description: Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28901
Published: 2021-05-24
Description: Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28902
Published: 2021-05-24
Description: Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28903
Published: 2021-05-24
Description: Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28904
Published: 2021-05-24
Description: Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28905
Published: 2021-05-24
Description: Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28906
Published: 2021-05-24
Description: Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28907
Published: 2021-05-24
Description: Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28908
Published: 2021-05-24
Description: Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28909
Published: 2021-05-24
Description: Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28910
Published: 2021-05-24
Description: Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28911
Published: 2021-05-24
Description: Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2021-32075
Published: 2021-05-24
Description: Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://store.steampowered.com/news/app/105600/view/[PII_REDACTED]626131236; https://terraria.fandom.com/wiki/1.4.2.3; https://twitter.com/relogicgames
CVE: CVE-2020-4990
Published: 2021-05-24
Description: IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 192710.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192710; https://www.ibm.com/support/pages/node/6455265; https://exchange.xforce.ibmcloud.com/vulnerabilities/192710
CVE: CVE-2021-20385
Published: 2021-05-24
Description: IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 195766.
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195766; https://www.ibm.com/support/pages/node/6455281; https://exchange.xforce.ibmcloud.com/vulnerabilities/195766
CVE: CVE-2021-20386
Published: 2021-05-24
Description: IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195767.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195767; https://www.ibm.com/support/pages/node/6455281; https://exchange.xforce.ibmcloud.com/vulnerabilities/195767
CVE: CVE-2021-20389
Published: 2021-05-24
Description: IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 195770.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/195770; https://www.ibm.com/support/pages/node/6455281; https://exchange.xforce.ibmcloud.com/vulnerabilities/195770
CVE: CVE-2021-20419
Published: 2021-05-24
Description: IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196280.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196280; https://www.ibm.com/support/pages/node/6455281; https://exchange.xforce.ibmcloud.com/vulnerabilities/196280
CVE: CVE-2021-20426
Published: 2021-05-24
Description: IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196313.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196313; https://www.ibm.com/support/pages/node/6455281; https://exchange.xforce.ibmcloud.com/vulnerabilities/196313
CVE: CVE-2021-20428
Published: 2021-05-24
Description: IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196315.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196315; https://www.ibm.com/support/pages/node/6455281; https://exchange.xforce.ibmcloud.com/vulnerabilities/196315
CVE: CVE-2021-20557
Published: 2021-05-24
Description: IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 199184.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199184; https://www.ibm.com/support/pages/node/6455269; https://exchange.xforce.ibmcloud.com/vulnerabilities/199184
CVE: CVE-2021-3485
Published: 2021-05-24
Description: An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-494, CWE-494
References: https://herolab.usd.de/security-advisories/usd-2021-0014/; https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769; https://herolab.usd.de/security-advisories/usd-2021-0014/
CVE: CVE-2021-33516
Published: 2021-05-24
Description: An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.
CVSS Score: 8.1 (HIGH)
References: https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536; https://gitlab.gnome.org/GNOME/gupnp/-/issues/24; https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536
CVE: CVE-2019-12348
Published: 2021-05-24
Description: An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/1; https://github.com/cby234/zzcms/issues/1
CVE: CVE-2021-29300
Published: 2021-05-24
Description: The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://advisory.checkmarx.net/advisory/CX-2021-4775; https://github.com/ronomon/opened/commit/7effe011d4fea8fac7f78c00615e0a6e69af68ec; https://advisory.checkmarx.net/advisory/CX-2021-4775
CVE: CVE-2021-33502
Published: 2021-05-24
Description: The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1
CVE: CVE-2021-32624
Published: 2021-05-24
Description: Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent behaviors and the fidelity of the exposed information. Under some circumstances, field values or field value meta data can be determined, despite the field or list having `read` access control configured. If you use private fields or lists, you may be impacted. No patches exist at this time. There are no workarounds at this time
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://github.com/keystonejs/keystone-5/security/advisories/GHSA-27g8-r9vw-765x; https://github.com/keystonejs/keystone-5/security/advisories/GHSA-27g8-r9vw-765x
CVE: CVE-2020-20907
Published: 2021-05-24
Description: MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://cwe.mitre.org/data/definitions/23.html; https://github.com/cby234/cve_request/issues/1; https://github.com/cby234/cve_request/issues/2
CVE: CVE-2020-21041
Published: 2021-05-24
Description: Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html; https://trac.ffmpeg.org/ticket/7989; https://www.debian.org/security/2021/dsa-4990
CVE: CVE-2020-26555
Published: 2021-05-24
Description: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://kb.cert.org/vuls/id/799380; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
CVE: CVE-2020-26556
Published: 2021-05-24
Description: Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://kb.cert.org/vuls/id/799380; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/; https://www.kb.cert.org/vuls/id/799380
CVE: CVE-2020-26557
Published: 2021-05-24
Description: Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute-force attack (unless the AuthValue is sufficiently random and changed each time).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://kb.cert.org/vuls/id/799380; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/; https://kb.cert.org/vuls/id/799380
CVE: CVE-2020-26558
Published: 2021-05-24
Description: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-287
References: https://kb.cert.org/vuls/id/799380; https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
CVE: CVE-2020-26559
Published: 2021-05-24
Description: Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://kb.cert.org/vuls/id/799380; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/; https://kb.cert.org/vuls/id/799380
CVE: CVE-2020-26560
Published: 2021-05-24
Description: Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://kb.cert.org/vuls/id/799380; https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/; https://kb.cert.org/vuls/id/799380
CVE: CVE-2021-29256
Published: 2021-05-24
Description: . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver; https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-29256
CVE: CVE-2021-30081
Published: 2021-05-24
Description: An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/emlog/emlog/issues/74; https://github.com/emlog/emlog/issues/74
CVE: CVE-2021-30082
Published: 2021-05-24
Description: An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dignajar/gris/issues/3; https://github.com/dignajar/gris/issues/3
CVE: CVE-2021-30083
Published: 2021-05-24
Description: An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/WebFairyNet/Mediat/issues/3; https://github.com/WebFairyNet/Mediat/issues/3
CVE: CVE-2020-20178
Published: 2021-05-24
Description: Ethereum 0xe933c0cd9784414d5f278c114904f5a84b396919#code.sol latest version is affected by a denial of service vulnerability in the affected payout function. Once the length of this array is too long, it will result in an exception. Attackers can make attacks by creating a series of account addresses.
CVSS Score: 7.5 (HIGH)
References: https://etherscan.io/address/0xe933c0cd9784414d5f278c114904f5a84b396919; https://etherscan.io/address/0xe933c0cd9784414d5f278c114904f5a84b396919