deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24610
Published: 2021-09-27
Description: The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164306/WordPress-TranslatePress-2.0.8-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/b87fcc2f-c2eb-4e23-9757-d1c590f26d3f; http://packetstormsecurity.com/files/164306/WordPress-TranslatePress-2.0.8-Cross-Site-Scripting.html
CVE: CVE-2021-24632
Published: 2021-09-27
Description: The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/55cd6d5e-92c1-407a-8c0f-f89d415ebb66; https://wpscan.com/vulnerability/55cd6d5e-92c1-407a-8c0f-f89d415ebb66
CVE: CVE-2021-24633
Published: 2021-09-27
Description: The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://wpscan.com/vulnerability/431901eb-0f95-4033-b943-324e6d3844a5; https://wpscan.com/vulnerability/431901eb-0f95-4033-b943-324e6d3844a5
CVE: CVE-2021-24634
Published: 2021-09-27
Description: The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a49c5a5b-57c0-4801-8bf1-cd3a05b12288; https://wpscan.com/vulnerability/a49c5a5b-57c0-4801-8bf1-cd3a05b12288
CVE: CVE-2021-24643
Published: 2021-09-27
Description: The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/240ddde9-095f-4919-832a-50279196dac5; https://wpscan.com/vulnerability/240ddde9-095f-4919-832a-50279196dac5
CVE: CVE-2021-24652
Published: 2021-09-27
Description: The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://wpscan.com/vulnerability/5375bd3e-a30d-4f24-9b17-470b28a8231c; https://wpscan.com/vulnerability/5375bd3e-a30d-4f24-9b17-470b28a8231c
CVE: CVE-2021-24659
Published: 2021-09-27
Description: The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5f2fe510-7513-4d33-82d9-3107b3b3f2ae; https://wpscan.com/vulnerability/5f2fe510-7513-4d33-82d9-3107b3b3f2ae
CVE: CVE-2021-24660
Published: 2021-09-27
Description: The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/af14ac23-843d-4f80-beaf-237618109edd; https://wpscan.com/vulnerability/af14ac23-843d-4f80-beaf-237618109edd
CVE: CVE-2021-24661
Published: 2021-09-27
Description: The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://wpscan.com/vulnerability/8d966ff1-9c88-43c7-8f4b-93c88e214677; https://wpscan.com/vulnerability/8d966ff1-9c88-43c7-8f4b-93c88e214677
CVE: CVE-2021-24666
Published: 2021-09-27
Description: The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/podlove/podlove-publisher/commit/aa8a343a2e2333b34a422f801adee09b020c6d76; https://wpscan.com/vulnerability/fb4d7988-60ff-4862-96a1-80b1866336fe; https://github.com/podlove/podlove-publisher/commit/aa8a343a2e2333b34a422f801adee09b020c6d76
CVE: CVE-2021-24670
Published: 2021-09-27
Description: The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a092548f-1ad5-44d3-9901-cdf4ebcee40a; https://wpscan.com/vulnerability/a092548f-1ad5-44d3-9901-cdf4ebcee40a
CVE: CVE-2021-24671
Published: 2021-09-27
Description: The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4e51dffa-027d-4f3d-a190-dcc5269f6435; https://wpscan.com/vulnerability/4e51dffa-027d-4f3d-a190-dcc5269f6435
CVE: CVE-2021-28613
Published: 2021-09-27
Description: Adobe Creative Cloud Desktop Application version 5.4 (and earlier) is affected by a file handling vulnerability that could allow an attacker to arbitrarily overwrite a file. Exploitation of this issue requires local access, administrator privileges and user interaction.
CVSS Score: 7.4 (HIGH)
CWE: CWE-379
References: https://helpx.adobe.com/security/products/creative-cloud/apsb21-76.html; https://helpx.adobe.com/security/products/creative-cloud/apsb21-76.html
CVE: CVE-2021-36841
Published: 2021-09-27
Description: Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/yith-maintenance-mode/wordpress-yith-maintenance-mode-plugin-1-3-7-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/yith-maintenance-mode/#developers; https://patchstack.com/database/vulnerability/yith-maintenance-mode/wordpress-yith-maintenance-mode-plugin-1-3-7-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36845
Published: 2021-09-27
Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the context, i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - "General" tab issues, vulnerable parameters: &yith_maintenance_message, &yith_maintenance_custom_style, &yith_maintenance_mascotte, &yith_maintenance_title_font[size], &yith_maintenance_title_font[family], &yith_maintenance_title_font[color], &yith_maintenance_paragraph_font[size], &yith_maintenance_paragraph_font[family], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" tab issues, vulnerable parameters: &yith_maintenance_background_image, &yith_maintenance_background_color. 4 - "Logo" tab issues, vulnerable parameters: &yith_maintenance_logo_image, &yith_maintenance_logo_tagline, &yith_maintenance_logo_tagline_font[size], &yith_maintenance_logo_tagline_font[family], &yith_maintenance_logo_tagline_font[color]. 5 - "Newsletter" tab issues, vulnerable parameters: &yith_maintenance_newsletter_email_font[size], &yith_maintenance_newsletter_email_font[family], &yith_maintenance_newsletter_email_font[color], &yith_maintenance_newsletter_submit_font[size], &yith_maintenance_newsletter_submit_font[family], &yith_maintenance_newsletter_submit_font[color], &yith_maintenance_newsletter_submit_background, &yith_maintenance_newsletter_submit_background_hover, &yith_maintenance_newsletter_title, &yith_maintenance_newsletter_action, &yith_maintenance_newsletter_email_label, &yith_maintenance_newsletter_email_name, &yith_maintenance_newsletter_submit_label, &yith_maintenance_newsletter_hidden_fields. 6 - "Socials" tab issues, vulnerable parameters: &yith_maintenance_socials_facebook, &yith_maintenance_socials_twitter, &yith_maintenance_socials_gplus, &yith_maintenance_socials_youtube, &yith_maintenance_socials_rss, &yith_maintenance_socials_skype, &yith_maintenance_socials_email, &yith_maintenance_socials_behance, &yith_maintenance_socials_dribble, &yith_maintenance_socials_flickr, &yith_maintenance_socials_instagram, &yith_maintenance_socials_pinterest, &yith_maintenance_socials_tumblr, &yith_maintenance_socials_linkedin.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/yith-maintenance-mode/wordpress-yith-maintenance-mode-plugin-1-3-8-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/yith-maintenance-mode/#developers; https://patchstack.com/database/vulnerability/yith-maintenance-mode/wordpress-yith-maintenance-mode-plugin-1-3-8-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2021-36874
Published: 2021-09-27
Description: Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).
CVSS Score: 7.1 (HIGH)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-authenticated-insecure-direct-object-references-idor-vulnerability; https://wordpress.org/plugins/ulisting/#developers; https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-authenticated-insecure-direct-object-references-idor-vulnerability
CVE: CVE-2021-36875
Published: 2021-09-27
Description: Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin – uListing: from n/a through 2.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-authenticated-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-authenticated-reflected-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/ulisting/#developers
CVE: CVE-2021-36876
Published: 2021-09-27
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-multiple-cross-site-request-forgery-csrf-vulnerabilities; https://wordpress.org/plugins/ulisting/#developers; https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-multiple-cross-site-request-forgery-csrf-vulnerabilities
CVE: CVE-2021-36877
Published: 2021-09-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-modify-user-roles-via-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/ulisting/#developers; https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-modify-user-roles-via-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2021-36879
Published: 2021-09-27
Description: Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-unauthenticated-privilege-escalation-vulnerability; https://wordpress.org/plugins/ulisting/#developers; https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-unauthenticated-privilege-escalation-vulnerability
CVE: CVE-2021-36880
Published: 2021-09-27
Description: Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-3-unauthenticated-sql-injection-sqli-vulnerability; https://wordpress.org/plugins/ulisting/#developers; https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-3-unauthenticated-sql-injection-sqli-vulnerability
CVE: CVE-2021-39818
Published: 2021-09-27
Description: Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/incopy/apsb21-71.html; https://helpx.adobe.com/security/products/incopy/apsb21-71.html
CVE: CVE-2021-39819
Published: 2021-09-27
Description: Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/incopy/apsb21-71.html; https://helpx.adobe.com/security/products/incopy/apsb21-71.html
CVE: CVE-2021-39823
Published: 2021-09-27
Description: Adobe svg-native-viewer 8182d14dfad5d1e10f53ed830328d7d9a3cfa96d and earlier versions are affected by a heap buffer overflow vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/svg-native-viewer/apsb21-72.html; https://helpx.adobe.com/security/products/svg-native-viewer/apsb21-72.html
CVE: CVE-2021-39824
Published: 2021-09-27
Description: Adobe Premiere Elements version 2[PII_REDACTED] (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious png file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html; https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html
CVE: CVE-2021-39825
Published: 2021-09-27
Description: Photoshop Elements versions 2021 build 19.0 (20210304.m.156367) (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious TTF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop_elements/apsb21-77.html; https://helpx.adobe.com/security/products/photoshop_elements/apsb21-77.html
CVE: CVE-2021-39826
Published: 2021-09-27
Description: Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary command execution vulnerability. An authenticated attacker could leverage this vulnerability to execute arbitrary commands. User interaction is required to abuse this vulnerability in that a user must open a maliciously crafted .epub file.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78, CWE-78
References: https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html; https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html
CVE: CVE-2021-39827
Published: 2021-09-27
Description: Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary file write vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to write an arbitrary file to the system. User interaction is required before product installation to abuse this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-379
References: https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html; https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html
CVE: CVE-2021-39828
Published: 2021-09-27
Description: Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by a privilege escalation vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this vulnerability.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-379
References: https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html; https://helpx.adobe.com/security/products/Digital-Editions/apsb21-80.html
CVE: CVE-2021-40700
Published: 2021-09-27
Description: Adobe Premiere Elements version 2[PII_REDACTED] (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html; https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html
CVE: CVE-2021-40701
Published: 2021-09-27
Description: Adobe Premiere Elements version 2[PII_REDACTED] (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html; https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html
CVE: CVE-2021-40702
Published: 2021-09-27
Description: Adobe Premiere Elements version 2[PII_REDACTED] (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious psd file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html; https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html
CVE: CVE-2021-40703
Published: 2021-09-27
Description: Adobe Premiere Elements version 2[PII_REDACTED] (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-119
References: https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html; https://helpx.adobe.com/security/products/premiere_elements/apsb21-78.html
CVE: CVE-2021-40709
Published: 2021-09-27
Description: Adobe Photoshop versions 21.2.11 (and earlier) and 22.5 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/photoshop/apsb21-84.html; https://helpx.adobe.com/security/products/photoshop/apsb21-84.html
CVE: CVE-2021-40711
Published: 2021-09-27
Description: Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can send a malformed POST request to achieve arbitrary code execution. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html
CVE: CVE-2021-40712
Published: 2021-09-27
Description: Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attacker can send a malformed POST request to achieve server-side denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html
CVE: CVE-2021-40713
Published: 2021-09-27
Description: Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would be able to harvest sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html
CVE: CVE-2021-40714
Published: 2021-09-27
Description: Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html
CVE: CVE-2021-23445
Published: 2021-09-27
Description: This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
CVSS Score: 3.1 (LOW)
CWE: CWE-79
References: https://cdn.datatables.net/1.11.3/; https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b; https://lists.debian.org/debian-lts-announce/2023/08/msg00018.html