deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-30301
Published: 2022-01-13
Description: Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30307
Published: 2022-01-13
Description: Possible denial of service due to improper validation of DNS response when DNS client requests with PTR, NAPTR or SRV query type in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30308
Published: 2022-01-13
Description: Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30311
Published: 2022-01-13
Description: Possible heap overflow due to lack of index validation before allocating and writing to heap buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30313
Published: 2022-01-13
Description: Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30314
Published: 2022-01-13
Description: Lack of validation for third party application accessing the service can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30319
Published: 2022-01-13
Description: Possible integer overflow due to improper validation of command length parameters while processing WMI command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30330
Published: 2022-01-13
Description: Possible null pointer dereference due to improper validation of APE clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-30353
Published: 2022-01-13
Description: Improper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE: CVE-2021-23514
Published: 2022-01-13
Description: This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/CrowCpp/Crow/pull/317; https://github.com/CrowCpp/Crow/releases/tag/v0.3%2B4; https://snyk.io/vuln/SNYK-UNMANAGED-CROW-2336163
CVE: CVE-2021-45806
Published: 2022-01-13
Description: jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://jpress.com; https://github.com/JPressProjects/jpress; https://github.com/JPressProjects/jpress/issues/166
CVE: CVE-2021-23824
Published: 2022-01-13
Description: This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/CrowCpp/Crow/pull/317; https://github.com/CrowCpp/Crow/releases/tag/v0.3%2B4; https://snyk.io/vuln/SNYK-UNMANAGED-CROW-2336164
CVE: CVE-2021-40327
Published: 2022-01-13
Description: Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: https://developer.arm.com/support/arm-security-updates; https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/; https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/profile_small_key_id_encoding_vulnerability.html
CVE: CVE-2022-23131
Published: 2022-01-13
Description: In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://support.zabbix.com/browse/ZBX-20350; https://support.zabbix.com/browse/ZBX-20350; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23131
CVE: CVE-2022-23132
Published: 2022-01-13
Description: During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
CVSS Score: 3.3 (LOW)
CWE: CWE-284, CWE-732
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/; https://support.zabbix.com/browse/ZBX-20341
CVE: CVE-2022-23133
Published: 2022-01-13
Description: An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/; https://support.zabbix.com/browse/ZBX-20388
CVE: CVE-2022-23134
Published: 2022-01-13
Description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
CVSS Score: 3.7 (LOW)
CWE: CWE-284, CWE-287
References: https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/
CVE: CVE-2022-22122
Published: 2022-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: This candidate is a reservation duplicate of [CVE-2021-37866]. Notes: All CVE users should reference [CVE-2021-37866] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-22123
Published: 2022-01-13
Description: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L391; https://github.com/halo-dev/halo/issues/1557; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22123
CVE: CVE-2022-22124
Published: 2022-01-13
Description: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/handler/file/FileHandler.java#L30; https://github.com/halo-dev/halo/issues/1575; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22124
CVE: CVE-2022-22125
Published: 2022-01-13
Description: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L500; https://github.com/halo-dev/halo/issues/1557; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22125
CVE: CVE-2021-39056
Published: 2022-01-13
Description: The IBM i 7.1, 7.2, 7.3, and 7.4 Extended Dynamic Remote SQL server (EDRSQL) could allow a remote authenticated user to send a specially crafted request and cause a denial of service. IBM X-Force ID: 214537.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214537; https://www.ibm.com/support/pages/node/6540294; https://exchange.xforce.ibmcloud.com/vulnerabilities/214537
CVE: CVE-2021-40567
Published: 2022-01-13
Description: Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c when using mp4box, which causes a denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/gpac/gpac/commit/f5a038e6893019ee471b6a57490cf7a495673816; https://github.com/gpac/gpac/issues/1889; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40568
Published: 2022-01-13
Description: A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/gpac/gpac/commit/f1ae01d745200a258cdf62622f71754c37cb6c30; https://github.com/gpac/gpac/issues/1900; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40569
Published: 2022-01-13
Description: The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/gpac/gpac/commit/b03c9f252526bb42fbd1b87b9f5e339c3cf2390a; https://github.com/gpac/gpac/issues/1890; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40570
Published: 2022-01-13
Description: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/gpac/gpac/commit/04dbf08bff4d61948bab80c3f9096ecc60c7f302; https://github.com/gpac/gpac/issues/1899; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40571
Published: 2022-01-13
Description: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/gpac/gpac/commit/a69b567b8c95c72f9560c873c5ab348be058f340; https://github.com/gpac/gpac/issues/1895; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40813
Published: 2022-01-13
Description: A cross-site scripting (XSS) vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.element-it.com/products.aspx; https://www.exploit-db.com/exploits/50645; https://www.element-it.com/products.aspx
CVE: CVE-2022-21678
Published: 2022-01-13
Description: Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6de; https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6c; https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564m
CVE: CVE-2021-40572
Published: 2022-01-13
Description: The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/gpac/gpac/commit/7bb1b4a4dd23c885f9db9f577dfe79ecc5433109; https://github.com/gpac/gpac/issues/1893; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40573
Published: 2022-01-13
Description: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/gpac/gpac/commit/b03c9f252526bb42fbd1b87b9f5e339c3cf2390a; https://github.com/gpac/gpac/issues/1891; https://github.com/gpac/gpac/commit/b03c9f252526bb42fbd1b87b9f5e339c3cf2390a
CVE: CVE-2021-40574
Published: 2022-01-13
Description: The binary MP4Box in Gpac from 0.9.0-preview to 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L232; https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L304; https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb
CVE: CVE-2021-40575
Published: 2022-01-13
Description: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/5f2c2a16d30229b6241f02fa28e3d6b810d64858; https://github.com/gpac/gpac/issues/1905; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-40576
Published: 2022-01-13
Description: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/ad18ece95fa064efc0995c4ab2c985f77fb166ec; https://github.com/gpac/gpac/issues/1904; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-45422
Published: 2022-01-13
Description: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://reprise.com; https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-45422/RLM%2014.2%20Cross%20Site%20Scripting.txt; https://seclists.org/fulldisclosure/2022/Jan/31
CVE: CVE-2021-45807
Published: 2022-01-13
Description: jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.
CVSS Score: 9.8 (CRITICAL)
References: http://jpress.com; https://github.com/JPressProjects/jpress; https://github.com/JPressProjects/jpress/issues/167
CVE: CVE-2021-23227
Published: 2022-01-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/php-everywhere/wordpress-php-everywhere-plugin-2-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/php-everywhere/wordpress-php-everywhere-plugin-2-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2021-33046
Published: 2022-01-13
Description: Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.dahuatech.com/networkSecurity/securityDetails?id=95; https://www.dahuasecurity.com/support/cybersecurity/details/957; https://www.dahuasecurity.com/support/cybersecurity/details/987
CVE: CVE-2021-40722
Published: 2022-01-13
Description: AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-43761
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-43762
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-43764
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-43765
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-44176
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
CVE: CVE-2021-44177
Published: 2022-01-13
Description: AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html; https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html