deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20254
Published: 2021-05-05
Description: A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1949442; https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EP2VJ73OVBPVSOSTVOMGIEQA3MWF6F7/
CVE: CVE-2020-13662
Published: 2021-05-05
Description: Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.drupal.org/sa-core-2020-003; https://www.drupal.org/sa-core-2020-003
CVE: CVE-2020-13664
Published: 2021-05-05
Description: Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.drupal.org/sa-core-2020-005; https://www.drupal.org/sa-core-2020-005
CVE: CVE-2020-13665
Published: 2021-05-05
Description: Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.
CVSS Score: 9.8 (CRITICAL)
References: https://www.drupal.org/sa-core-2020-006; https://www.drupal.org/sa-core-2020-006
CVE: CVE-2021-31517
Published: 2021-05-05
Description: Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31518.
CVSS Score: 7.5 (HIGH)
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10312; https://helpcenter.trendmicro.com/en-us/article/TMKA-10312
CVE: CVE-2021-31518
Published: 2021-05-05
Description: Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31517.
CVSS Score: 7.5 (HIGH)
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10312; https://helpcenter.trendmicro.com/en-us/article/TMKA-10312
CVE: CVE-2021-31542
Published: 2021-05-05
Description: In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2021/05/04/3; https://docs.djangoproject.com/en/3.2/releases/security/; https://github.com/django/django/commit/04ac1624bdc2fa[PII_REDACTED]57cf95ced122d26d
CVE: CVE-2020-4883
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the system. IBM X-Force ID: 190907.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190907; https://www.ibm.com/support/pages/node/6449678; https://exchange.xforce.ibmcloud.com/vulnerabilities/190907
CVE: CVE-2020-4929
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191706.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191706; https://www.ibm.com/support/pages/node/6449674; https://exchange.xforce.ibmcloud.com/vulnerabilities/191706
CVE: CVE-2020-4932
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 191748.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191748; https://www.ibm.com/support/pages/node/6449682; https://exchange.xforce.ibmcloud.com/vulnerabilities/191748
CVE: CVE-2020-4979
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538.
CVSS Score: 9.8 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192538; https://www.ibm.com/support/pages/node/6449668; https://exchange.xforce.ibmcloud.com/vulnerabilities/192538
CVE: CVE-2020-4993
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path traversal attacks. IBM X-Force ID: 192905.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192905; https://www.ibm.com/support/pages/node/6449672; https://exchange.xforce.ibmcloud.com/vulnerabilities/192905
CVE: CVE-2020-5013
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 193245.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193245; https://www.ibm.com/support/pages/node/6449690; https://exchange.xforce.ibmcloud.com/vulnerabilities/193245
CVE: CVE-2021-20397
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196017.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196017; https://www.ibm.com/support/pages/node/6449688; https://exchange.xforce.ibmcloud.com/vulnerabilities/196017
CVE: CVE-2021-20401
Published: 2021-05-05
Description: IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196075.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196075; https://www.ibm.com/support/pages/node/6449682; https://exchange.xforce.ibmcloud.com/vulnerabilities/196075
CVE: CVE-2021-29100
Published: 2021-05-05
Description: A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.esri.com/arcgis-blog/products/arcgis-earth/administration/arcgis-earth-security-update; https://www.esri.com/arcgis-blog/products/arcgis-earth/administration/arcgis-earth-security-update
CVE: CVE-2021-29489
Published: 2021-05-05
Description: Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95
CVE: CVE-2021-32055
Published: 2021-05-05
Description: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20210503/000036.html; https://github.com/neomutt/neomutt/commit/fa1db5785e5cfd9d3cd27b7571b9fe268d2ec2dc; https://gitlab.com/muttmua/mutt/-/commit/7c4779ac24d2fb68a2a47b58c7904118f40965d5
CVE: CVE-2021-24255
Published: 2021-05-05
Description: The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7fb708da-e8c4-4455-b4f9-c4ad72f877da; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/7fb708da-e8c4-4455-b4f9-c4ad72f877da
CVE: CVE-2021-24256
Published: 2021-05-05
Description: The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a9412fed-aed3-4931-a504-1a86f876892e; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/a9412fed-aed3-4931-a504-1a86f876892e
CVE: CVE-2021-24257
Published: 2021-05-05
Description: The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4ad8314e-1cbe-4642-b4ee-aac2060f9a25; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/4ad8314e-1cbe-4642-b4ee-aac2060f9a25
CVE: CVE-2021-24258
Published: 2021-05-05
Description: The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/47b47b86-899b-4de3-8a3c-2d5d1774298f; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/47b47b86-899b-4de3-8a3c-2d5d1774298f
CVE: CVE-2021-24259
Published: 2021-05-05
Description: The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0719063f-7743-4a34-94b9-f67fd98e5990; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/0719063f-7743-4a34-94b9-f67fd98e5990
CVE: CVE-2021-24260
Published: 2021-05-05
Description: The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fa6c7c7c-1027-4fa9-bb55-07ae2bb7f021; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/fa6c7c7c-1027-4fa9-bb55-07ae2bb7f021
CVE: CVE-2021-24261
Published: 2021-05-05
Description: The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0377705d-29e9-47db-a5bb-8acaf311a38f; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/0377705d-29e9-47db-a5bb-8acaf311a38f
CVE: CVE-2021-24262
Published: 2021-05-05
Description: The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d6d16357-2bc3-4053-8274-d0275026e56b; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/d6d16357-2bc3-4053-8274-d0275026e56b
CVE: CVE-2021-24263
Published: 2021-05-05
Description: The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/48876006-b00f-49b7-80a1-b1d6dc2f4eec; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/48876006-b00f-49b7-80a1-b1d6dc2f4eec
CVE: CVE-2021-24264
Published: 2021-05-05
Description: The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/7fd89a49-fbb0-4308-836b-1f12dc585b1f; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/7fd89a49-fbb0-4308-836b-1f12dc585b1f
CVE: CVE-2021-24265
Published: 2021-05-05
Description: The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9f4771dc-80b5-49ff-9f64-bf6c36f76863; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/9f4771dc-80b5-49ff-9f64-bf6c36f76863
CVE: CVE-2021-24266
Published: 2021-05-05
Description: The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/78014ddd-1cc2-4723-8194-4bf478888578; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/78014ddd-1cc2-4723-8194-4bf478888578
CVE: CVE-2021-24267
Published: 2021-05-05
Description: The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0c96f3a1-d192-481f-9035-5393f4aadc19; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/0c96f3a1-d192-481f-9035-5393f4aadc19
CVE: CVE-2021-24268
Published: 2021-05-05
Description: The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/68ecb965-2a9d-4e67-b069-c3dbfb14016b; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/68ecb965-2a9d-4e67-b069-c3dbfb14016b
CVE: CVE-2021-24269
Published: 2021-05-05
Description: The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/df953a91-f1d8-42e9-8966-f2012d4f97c9; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/df953a91-f1d8-42e9-8966-f2012d4f97c9
CVE: CVE-2021-24270
Published: 2021-05-05
Description: The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/67967784-18b6-4e41-9597-3a4c051f3978; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/67967784-18b6-4e41-9597-3a4c051f3978
CVE: CVE-2021-24271
Published: 2021-05-05
Description: The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1ce8e188-6ded-413e-b4d1-bf80258acf79; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/1ce8e188-6ded-413e-b4d1-bf80258acf79
CVE: CVE-2021-24272
Published: 2021-05-05
Description: The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/164261/WordPress-Fitness-Calculators-1.9.5-Cross-Site-Request-Forgery.html; https://wpscan.com/vulnerability/e643040b-1f3b-4c13-8a20-acfd069dcc4f; http://packetstormsecurity.com/files/164261/WordPress-Fitness-Calculators-1.9.5-Cross-Site-Request-Forgery.html
CVE: CVE-2021-24273
Published: 2021-05-05
Description: The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/70ddb3fd-d819-4d85-9f8b-1451a3e3e5a6; https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/; https://wpscan.com/vulnerability/70ddb3fd-d819-4d85-9f8b-1451a3e3e5a6
CVE: CVE-2021-24274
Published: 2021-05-05
Description: The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164316/WordPress-Ultimate-Maps-1.2.4-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/200a3031-7c42-4189-96b1-bed9e0ab7c1d; http://packetstormsecurity.com/files/164316/WordPress-Ultimate-Maps-1.2.4-Cross-Site-Scripting.html
CVE: CVE-2021-24275
Published: 2021-05-05
Description: The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164311/WordPress-Popup-1.10.4-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/efdc76e0-c14a-4baf-af70-9d381107308f; http://packetstormsecurity.com/files/164311/WordPress-Popup-1.10.4-Cross-Site-Scripting.html
CVE: CVE-2021-24276
Published: 2021-05-05
Description: The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164308/WordPress-Contact-Form-1.7.14-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/1301123c-5e63-432a-ab90-3221ca532d9c; http://packetstormsecurity.com/files/164308/WordPress-Contact-Form-1.7.14-Cross-Site-Scripting.html
CVE: CVE-2021-24293
Published: 2021-05-05
Description: In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5e1a4725-3d20-44b0-8a35-bbf4263957f7; https://www.imagely.com/wordpress-gallery-plugin/nextgen-pro/changelog/; https://wpscan.com/vulnerability/5e1a4725-3d20-44b0-8a35-bbf4263957f7
CVE: CVE-2021-29101
Published: 2021-05-05
Description: ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.esri.com/arcgis-blog/products/ext-server-geoevent/administration/arcgis-geoevent-server-security-update-2021-patch-1; https://www.esri.com/arcgis-blog/products/ext-server-geoevent/administration/arcgis-geoevent-server-security-update-2021-patch-1
CVE: CVE-2021-31411
Published: 2021-05-05
Description: Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-379
References: https://github.com/vaadin/flow/pull/10640; https://vaadin.com/security/cve-2021-31411; https://github.com/vaadin/flow/pull/10640