deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26797
Published: 2021-03-18
Description: Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYI2372RLWYQVLSYD5PBI4YTXNMVDZCZ/; https://sourceforge.net/p/mediainfo/bugs/1154/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYI2372RLWYQVLSYD5PBI4YTXNMVDZCZ/
CVE: CVE-2020-26886
Published: 2021-03-18
Description: Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Stores. This leads to privilege escalation on the local host.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://vulnerable.af; https://vulnerable.af/posts/cve-2020-26886/; https://www.softaculous.com/board/index.php?tid=17086&title=Softaculous_5.5.7_Launched
CVE: CVE-2020-36144
Published: 2021-03-18
Description: Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the search filter lacks sanitization.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/getredash/redash/issues/5426; https://github.com/getredash/redash/releases; https://github.com/getredash/redash/issues/5426
CVE: CVE-2020-9367
Published: 2021-03-18
Description: The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because this DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code, leading to an escalation of privilege to NT AUTHORITY\SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.manageengine.com/desktop-management-msp/dll-hijacking-vulnerability.html; https://www.manageengine.com/desktop-management-msp/dll-hijacking-vulnerability.html
CVE: CVE-2021-25764
Published: 2021-03-18
Description: In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-27358
Published: 2021-03-18
Description: The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
CVSS Score: 7.5 (HIGH)
References: https://github.com/grafana/grafana/blob/master/CHANGELOG.md; https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17; https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
CVE: CVE-2021-3416
Published: 2021-03-18
Description: A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1932827; https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2021-27436
Published: 2021-03-18
Description: WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-075-01; https://us-cert.cisa.gov/ics/advisories/icsa-21-075-01
CVE: CVE-2021-21384
Published: 2021-03-19
Description: shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-88
References: https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b; https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3; https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh
CVE: CVE-2021-26275
Published: 2021-03-19
Description: The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://advisory.checkmarx.net/advisory/CX-2021-4774; https://www.npmjs.com/package/eslint-fixer; https://advisory.checkmarx.net/advisory/CX-2021-4774
CVE: CVE-2021-28653
Published: 2021-03-19
Description: The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferred storage mechanism if the device has Secure Enclave support but lacks biometric authentication hardware.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: https://www.westerndigital.com/support/productsecurity/wdc-21003-armorLock-insecure-key-storage-vulnerability; https://www.westerndigital.com/support/productsecurity/wdc-21003-armorLock-insecure-key-storage-vulnerability
CVE: CVE-2021-27221
Published: 2021-03-19
Description: MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work
CVSS Score: 8.1 (HIGH)
References: https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe; https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe
CVE: CVE-2021-27928
Published: 2021-03-19
Description: A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/162177/MariaDB-10.2-Command-Execution.html; https://jira.mariadb.org/browse/MDEV-25179; https://lists.debian.org/debian-lts-announce/2021/03/msg00028.html
CVE: CVE-2021-28109
Published: 2021-03-19
Description: TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf; https://www.tadviser.ru/index.php/%D0%9F%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82:TranzWare_Online; https://gist.github.com/ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf
CVE: CVE-2021-3327
Published: 2021-03-19
Description: Ovation Dynamic Content 1.10.1 for Elementor allows XSS via the post_title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/IthacaLabs/e69e90e1d0d9cb37bb3746b6a4274d29; https://www.dynamic.ooo/changelog/; https://gist.github.com/IthacaLabs/e69e90e1d0d9cb37bb3746b6a4274d29
CVE: CVE-2020-6577
Published: 2021-03-19
Description: The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext_language SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2019-0072/; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-6578
Published: 2021-03-19
Description: Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2019-0069/; https://herolab.usd.de/security-advisories/
CVE: CVE-2021-25289
Published: 2021-03-19
Description: An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html; https://security.gentoo.org/glsa/202107-33; https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
CVE: CVE-2021-25290
Published: 2021-03-19
Description: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html; https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html; https://security.gentoo.org/glsa/202107-33
CVE: CVE-2021-25291
Published: 2021-03-19
Description: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html; https://security.gentoo.org/glsa/202107-33; https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
CVE: CVE-2021-25292
Published: 2021-03-19
Description: An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html; https://security.gentoo.org/glsa/202107-33; https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
CVE: CVE-2021-25293
Published: 2021-03-19
Description: An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html; https://security.gentoo.org/glsa/202107-33; https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
CVE: CVE-2021-28110
Published: 2021-03-19
Description: /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://gist.github.com/kukuxumushi/0b7d90a917ac3480066c4cbf7519b40a; https://gist.github.com/kukuxumushi/0b7d90a917ac3480066c4cbf7519b40a
CVE: CVE-2021-28126
Published: 2021-03-19
Description: index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/kukuxumushi/7436994ef395573023b79652e104a2a0; https://gist.github.com/kukuxumushi/7436994ef395573023b79652e104a2a0
CVE: CVE-2020-25097
Published: 2021-03-19
Description: An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-444
References: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch; http://www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patch; https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6
CVE: CVE-2021-28089
Published: 2021-03-19
Description: Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://blog.torproject.org/node/2009; https://gitlab.torproject.org/tpo/core/tor/-/issues/40304; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/
CVE: CVE-2021-28090
Published: 2021-03-19
Description: Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://blog.torproject.org/node/2009; https://bugs.torproject.org/tpo/core/tor/40316; https://gitlab.torproject.org/tpo/core/tor/-/issues/40316
CVE: CVE-2021-28831
Published: 2021-03-19
Description: decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd; https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/
CVE: CVE-2021-28834
Published: 2021-03-19
Description: Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/gettalong/kramdown/compare/REL_2_3_0...REL_2_3_1; https://github.com/gettalong/kramdown/pull/708; https://gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d06b4ed6ccb66
CVE: CVE-2021-27506
Published: 2021-03-19
Description: The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.
CVSS Score: 5.5 (MEDIUM)
References: https://advisories.stormshield.eu/2021-003/; https://blog.clamav.net/2021/02/clamav-01031-patch-release.html; https://advisories.stormshield.eu/2021-003/
CVE: CVE-2020-4635
Published: 2021-03-19
Description: IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185502; https://www.ibm.com/support/pages/node/6431265; https://exchange.xforce.ibmcloud.com/vulnerabilities/185502
CVE: CVE-2021-21387
Published: 2021-03-19
Description: Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connection. Additionally, the safety number was improperly calculated. It was computed using part of one of the public identity keys instead of being derived from both public identity keys. This caused issues in computing safety numbers which would potentially be exploitable in the real world. Additionally there was inadequate encryption strength due to use of 1024-bit DSA keys. These issues are all fixed in version 2.3.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319, CWE-326, CWE-358
References: https://github.com/parabirb/wrongthink/security/advisories/GHSA-5jxh-6378-rg7v; https://github.com/parabirb/wrongthink/security/advisories/GHSA-5jxh-6378-rg7v
CVE: CVE-2021-21390
Published: 2021-03-19
Description: MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature. This is fixed in version RELEASE.2021-03-17T02-33-02Z. As a workaround one can avoid using "aws-chunked" encoding-based chunk signature upload requests instead use TLS. MinIO SDKs automatically disable chunked encoding signature when the server endpoint is configured with TLS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-924, CWE-924
References: https://github.com/minio/minio/commit/e197800f[PII_REDACTED]b53cf137e31e194aaf7ba0; https://github.com/minio/minio/pull/11801; https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp
CVE: CVE-2021-27807
Published: 2021-03-19
Description: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-834, CWE-834
References: http://www.openwall.com/lists/oss-security/2021/03/19/9; https://lists.apache.org/thread.html/r043edc5dcf9199f7f882ed7906b41cb816753766e88b8792dbf319a9%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E
CVE: CVE-2021-27906
Published: 2021-03-19
Description: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-789
References: http://www.openwall.com/lists/oss-security/2021/03/19/10; https://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3E; https://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3E
CVE: CVE-2021-25277
Published: 2021-03-19
Description: FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25277; https://www.ftapi.com/release-notes/; https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25277
CVE: CVE-2021-25278
Published: 2021-03-19
Description: FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25278; https://www.ftapi.com/release-notes/; https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25278
CVE: CVE-2019-10127
Published: 2021-03-19
Description: A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1707098; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.postgresql.org/about/news/1939/
CVE: CVE-2021-20077
Published: 2021-03-19
Description: Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
CVSS Score: 6.7 (MEDIUM)
References: https://www.tenable.com/security/tns-2021-04-0; https://www.tenable.com/security/tns-2021-04-0; https://www.tenable.com/security/tns-2021-07
CVE: CVE-2021-26990
Published: 2021-03-19
Description: Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26991
Published: 2021-03-19
Description: Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Cloud Manager.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26992
Published: 2021-03-19
Description: Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-27519
Published: 2021-03-19
Description: A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html; https://github.com/fudforum/FUDforum/issues/2; http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html
CVE: CVE-2021-27520
Published: 2021-03-19
Description: A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html; https://github.com/fudforum/FUDforum/issues/2; http://packetstormsecurity.com/files/162942/FUDForum-3.1.0-Cross-Site-Scripting.html
CVE: CVE-2019-10128
Published: 2021-03-19
Description: A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1707102; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.postgresql.org/about/news/1939/
CVE: CVE-2019-10151
Published: 2021-03-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none