deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-3486
Published: 2023-07-25
Description: An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected.

CVSS Score: 8.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/; https://www.tenable.com/security/research/tra-2023-23; https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/
CVE: CVE-2023-3637
Published: 2023-07-25
Description: An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://access.redhat.com/errata/RHSA-2023:4283; https://access.redhat.com/security/cve/CVE-2023-3637; https://bugzilla.redhat.com/show_bug.cgi?id=2222270
CVE: CVE-2023-34017
Published: 2023-07-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin <= 2.6.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/restaurant-reservations/wordpress-five-star-restaurant-reservations-plugin-2-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/restaurant-reservations/wordpress-five-star-restaurant-reservations-plugin-2-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34369
Published: 2023-07-25
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/login-configurator/wordpress-login-configurator-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/login-configurator/wordpress-login-configurator-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36385
Published: 2023-07-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin <= 2.9.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-post/wordpress-postx-gutenberg-post-grid-blocks-plugin-2-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-post/wordpress-postx-gutenberg-post-grid-blocks-plugin-2-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36501
Published: 2023-07-25
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 9.0.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36502
Published: 2023-07-25
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/balkon/wordpress-balkon-theme-1-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/balkon/wordpress-balkon-theme-1-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36503
Published: 2023-07-25
Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/maxbuttons/wordpress-wordpress-button-plugin-maxbuttons-plugin-9-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/maxbuttons/wordpress-wordpress-button-plugin-maxbuttons-plugin-9-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3548
Published: 2023-07-25
Description: An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.

CVSS Score: 8.3 (HIGH)
CWE: CWE-307, CWE-307
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-04; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-04
CVE: CVE-2023-34093
Published: 2023-07-25
Description: Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/strapi/strapi/commit/2fa8f30371bfd1db44c15e5747860ee5789096de; https://github.com/strapi/strapi/releases/tag/v4.10.8; https://github.com/strapi/strapi/security/advisories/GHSA-chmr-rg2f-9jmf
CVE: CVE-2023-37895
Published: 2023-07-25
Description: Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI.

Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.

In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.

How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.

The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check.

RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.

Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:

        <servlet>
            <servlet-name>RMI</servlet-name>
            <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class>
        </servlet>

        <servlet-mapping>
            <servlet-name>RMI</servlet-name>
            <url-pattern>/rmi</url-pattern>
        </servlet-mapping>

Find the bootstrap.properties file (in $REPOSITORY_HOME), and set

         rmi.enabled=false

    and also remove

         rmi.host
         rmi.port
         rmi.url-pattern

 If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://seclists.org/fulldisclosure/2023/Jul/43; http://www.openwall.com/lists/oss-security/2023/07/25/8; https://lists.apache.org/list.html?users@jackrabbit.apache.org
CVE: CVE-2023-39173
Published: 2023-07-25
Description: In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-39174
Published: 2023-07-25
Description: In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-39175
Published: 2023-07-25
Description: In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38435
Published: 2023-07-25
Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack.

Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://seclists.org/fulldisclosure/2023/Jul/43; http://www.openwall.com/lists/oss-security/2023/07/25/10; https://lists.apache.org/thread/r3blhp3onr4rdbkgdyglqnccg0v79pfv
CVE: CVE-2023-3772
Published: 2023-07-25
Description: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2023:6583; https://access.redhat.com/errata/RHSA-2023:6901; https://access.redhat.com/errata/RHSA-2023:7077
CVE: CVE-2023-3773
Published: 2023-07-25
Description: A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2023:6583; https://access.redhat.com/security/cve/CVE-2023-3773; https://bugzilla.redhat.com/show_bug.cgi?id=2218944
CVE: CVE-2023-2626
Published: 2023-07-25
Description: There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key to bypass security checks, resulting in arbitrary IP packets being allowed on the Thread network.
 This provides a pathway for an attacker to send/receive arbitrary IPv6 packets to devices on the LAN, potentially exploiting them if they lack additional authentication or contain any network vulnerabilities that would normally be mitigated by the home router’s NAT firewall. Effected devices have been mitigated through an automatic update beyond the affected range.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://support.google.com/product-documentation/answer/13588832?hl=en&ref_topic=12974021&sjid=[PII_REDACTED]896465963-NA#zippy=%2Cnest-wifi; https://support.google.com/product-documentation/answer/13588832?hl=en&ref_topic=12974021&sjid=[PII_REDACTED]896465963-NA#zippy=%2Cnest-wifi
CVE: CVE-2023-34235
Published: 2023-07-25
Description: Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: https://github.com/strapi/strapi/releases/tag/v4.10.8; https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f; https://github.com/strapi/strapi/releases/tag/v4.10.8
CVE: CVE-2023-35929
Published: 2023-07-25
Description: Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. A malicious user with the capability to create an artifact or to edit a field used as a card field could force victim to execute uncontrolled code. Tuleap Community Edition 14.10.99.4, Tuleap Enterprise Edition 14.10-2, and Tuleap Enterprise Edition 14.9-5 contain a fix.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d; https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d
CVE: CVE-2023-35941
Published: 2023-07-25
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.
CVSS Score: 8.6 (HIGH)
CWE: CWE-116
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55; https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55
CVE: CVE-2023-35942
Published: 2023-07-25
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, disable gRPC access log or stop listener update.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4; https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4
CVE: CVE-2023-35943
Published: 2023-07-25
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the `origin` header in the Envoy configuration.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq; https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq
CVE: CVE-2023-35944
Published: 2023-07-25
Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-444
References: https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g; https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g
CVE: CVE-2023-35980
Published: 2023-07-25
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt
CVE: CVE-2023-35981
Published: 2023-07-25
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt
CVE: CVE-2023-35982
Published: 2023-07-25
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt
CVE: CVE-2023-36806
Published: 2023-07-25
Description: Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/contao/contao/commit/5c9aff32cfc1f7dc452a045862ac2f86a6b9b4b4; https://github.com/contao/contao/commit/c98585d36baa25fda69c062421e7e7eadc53c82b; https://github.com/contao/contao/commit/ccb64c777eb0f9c0e6490c9135d80e915d37cd32
CVE: CVE-2023-36826
Published: 2023-07-25
Description: Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-863, CWE-863
References: https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9; https://github.com/getsentry/sentry/pull/49680; https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
CVE: CVE-2023-39128
Published: 2023-07-25
Description: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceware.org/bugzilla/show_bug.cgi?id=30639; https://sourceware.org/bugzilla/show_bug.cgi?id=30639
CVE: CVE-2023-39129
Published: 2023-07-25
Description: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://sourceware.org/bugzilla/show_bug.cgi?id=30640; https://sourceware.org/bugzilla/show_bug.cgi?id=30640
CVE: CVE-2023-39130
Published: 2023-07-25
Description: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceware.org/bugzilla/show_bug.cgi?id=30641; https://sourceware.org/bugzilla/show_bug.cgi?id=30641
CVE: CVE-2020-35698
Published: 2023-07-25
Description: Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: Affected Source code of the website CMS which is been used by many to host their online courses using the Thinkific Platform. The attack vector is: To exploit the vulnerability any user has to just visit the link - https://hacktify.thinkific.com/account/billing?success=%E2%80%AA%3Cscript%3Ealert(1)%3C/script%3E. ¶¶ Thinkific is a Website based Learning Platform Product which is used by thousands of users worldwide. There is a Cross Site Scripting (XSS) based vulnerability in the code of the CMS where any attacker can execute a XSS attack. Proof of Concept & Steps to Reproduce: Step1 : Go to Google.com Step 2 : Search for this Dork site:thinkific.com -www Step 3 : You will get a list of websites which are running on the thinkific domains. Step 4 : Create account and signin in any of the website Step 5 : Add this endpoint at the end of the domain and you will see that there is a XSS Alert /account/billing?success=%E2%80%AA<script>alert(1)</script> Step 6 : Choose any domains from google for any website this exploit will work on all the websites as it is a code based flaw in the CMS Step 7 : Thousands of websites are vulnerable due to this vulnerable code in the CMS itself which is giving rise to the XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40rohitgautam26/cve-2020-35698-a922189c42ef; https://medium.com/%40rohitgautam26/cve-2020-35698-a922189c42ef