deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-36329
Published: 2021-11-30
Description: Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this vulnerability to gain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities; https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities
CVE: CVE-2021-36330
Published: 2021-11-30
Description: Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to reuse old session artifacts to impersonate a legitimate user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities; https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities
CVE: CVE-2021-41256
Published: 2021-11-30
Description: nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-829
References: https://github.com/nextcloud/news-android/blob/master/security/GHSL-2021-1033_Nextcloud_News_for_Android.md; https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85; https://github.com/nextcloud/news-android/security/advisories/GHSA-2q9v-q3cc-h9f3
CVE: CVE-2021-40809
Published: 2021-12-01
Description: An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://blog.assetnote.io/2021/11/30/jamf-ssrf/; https://docs.jamf.com/10.32.0/jamf-pro/release-notes/Resolved_Issues.html; https://www.jamf.com/resources/product-documentation/jamf-pro-release-notes/
CVE: CVE-2021-43358
Published: 2021-12-01
Description: Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.twcert.org.tw/tw/cp-132-5353-4ebee-1.html; https://www.twcert.org.tw/tw/cp-132-5353-4ebee-1.html
CVE: CVE-2021-43359
Published: 2021-12-01
Description: Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://www.twcert.org.tw/tw/cp-132-5354-0aac0-1.html; https://www.twcert.org.tw/tw/cp-132-5354-0aac0-1.html
CVE: CVE-2021-43360
Published: 2021-12-01
Description: Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.twcert.org.tw/tw/cp-132-5355-6e339-1.html; https://www.twcert.org.tw/tw/cp-132-5355-6e339-1.html
CVE: CVE-2021-20847
Published: 2021-12-01
Description: Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN19482703/index.html; https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html; https://jvn.jp/en/jp/JVN19482703/index.html
CVE: CVE-2021-20851
Published: 2021-12-01
Description: Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN93562098/index.html; https://wordpress.org/plugins/browser-and-operating-system-finder/; https://jvn.jp/en/jp/JVN93562098/index.html
CVE: CVE-2021-20852
Published: 2021-12-01
Description: Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute an arbitrary OS command via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20853
Published: 2021-12-01
Description: ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20854
Published: 2021-12-01
Description: ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20855
Published: 2021-12-01
Description: Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20856
Published: 2021-12-01
Description: Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20857
Published: 2021-12-01
Description: Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20858
Published: 2021-12-01
Description: Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20859
Published: 2021-12-01
Description: ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attacker to execute an arbitrary OS command via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20860
Published: 2021-12-01
Description: Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a remote authenticated attacker to hijack the authentication of an administrator via a specially crafted page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20861
Published: 2021-12-01
Description: Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attacker to bypass access restriction and to access the management screen of the product via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/en/jp/JVN88993473/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/index.html
CVE: CVE-2021-20862
Published: 2021-12-01
Description: Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent unauthenticated attacker to bypass access restriction, and to obtain anti-CSRF tokens and change the product's settings via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/vu/JVNVU94527926/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/vu/JVNVU94527926/index.html
CVE: CVE-2021-20863
Published: 2021-12-01
Description: OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attackers to execute an arbitrary OS command with the root privilege via unspecified vectors.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU94527926/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/vu/JVNVU94527926/index.html
CVE: CVE-2021-20864
Published: 2021-12-01
Description: Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent unauthenticated attacker to bypass access restriction, and to start the telnet service and execute an arbitrary OS command via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/en/vu/JVNVU94527926/index.html; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/vu/JVNVU94527926/index.html
CVE: CVE-2021-34599
Published: 2021-12-01
Description: Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16959&token=3ce11e44a3277c4520d732ea2e630f2e06bd46ff&download; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16959&token=3ce11e44a3277c4520d732ea2e630f2e06bd46ff&download
CVE: CVE-2021-4018
Published: 2021-12-01
Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/snipe/snipe-it/commit/ff81e6d5366c2cfb15618793ad919ae4cbb3ac57; https://huntr.dev/bounties/c14395f6-bf0d-4b06-b4d1-b509d8a99b54; https://github.com/snipe/snipe-it/commit/ff81e6d5366c2cfb15618793ad919ae4cbb3ac57
CVE: CVE-2021-4019
Published: 2021-12-01
Description: vim is vulnerable to Heap-based Buffer Overflow
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2022/01/15/1; https://github.com/vim/vim/commit/bd228fd097b41a798f90944b5d1245eddd484142; https://huntr.dev/bounties/d8798584-a6c9-4619-b18f-001b9a6fca92
CVE: CVE-2021-3984
Published: 2021-12-01
Description: vim is vulnerable to Heap-based Buffer Overflow
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2022/01/15/1; https://github.com/vim/vim/commit/2de9b7c7c8791da8853a9a7ca9c467867465b655; https://huntr.dev/bounties/b114b5a2-18e2-49f0-b350-15994d71426a
CVE: CVE-2021-3985
Published: 2021-12-01
Description: kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5; https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4; https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5
CVE: CVE-2021-3989
Published: 2021-12-01
Description: showdoc is vulnerable to URL Redirection to Untrusted Site
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/star7th/showdoc/commit/335afc7ed6d6627c3d0434aa9acc168c77117614; https://huntr.dev/bounties/ffc61eff-efea-42c5-92c2-e043fdf904d5; https://github.com/star7th/showdoc/commit/335afc7ed6d6627c3d0434aa9acc168c77117614
CVE: CVE-2021-3990
Published: 2021-12-01
Description: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-338
References: https://github.com/star7th/showdoc/commit/a9886f26c08225e0adca75c67dfca3f7c42b87d0; https://huntr.dev/bounties/0680067d-56a7-4412-b06e-a267e850ae9f; https://github.com/star7th/showdoc/commit/a9886f26c08225e0adca75c67dfca3f7c42b87d0
CVE: CVE-2021-3992
Published: 2021-12-01
Description: kimai2 is vulnerable to Improper Access Control
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-639
References: https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e[PII_REDACTED]ef15fe4ab028ea5; https://huntr.dev/bounties/a0c438fb-c8e1-40cf-acc6-c8a532b80b93; https://github.com/kevinpapst/kimai2/commit/ff9acab0fc81f0e[PII_REDACTED]ef15fe4ab028ea5
CVE: CVE-2021-3993
Published: 2021-12-01
Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/star7th/showdoc/commit/654e871a3923e79076818a9a03533fe88222c871; https://huntr.dev/bounties/0aa84736-139b-4ae7-becf-604f7f60b1c9; https://github.com/star7th/showdoc/commit/654e871a3923e79076818a9a03533fe88222c871
CVE: CVE-2021-3994
Published: 2021-12-01
Description: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/django-helpdesk/django-helpdesk/commit/a22eb0673fe0b7784f99c6b5fd343b64a6700f06; https://huntr.dev/bounties/be7f211d-4bfd-44fd-91e8-682329906fbd; https://github.com/django-helpdesk/django-helpdesk/commit/a22eb0673fe0b7784f99c6b5fd343b64a6700f06
CVE: CVE-2021-4015
Published: 2021-12-01
Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/firefly-iii/firefly-iii/commit/518b4ba5a7a[PII_REDACTED]8ae0a2c6a392c2f4d37; https://huntr.dev/bounties/b698d445-602d-4701-961c-dffe6d3009b1; https://github.com/firefly-iii/firefly-iii/commit/518b4ba5a7a[PII_REDACTED]8ae0a2c6a392c2f4d37
CVE: CVE-2021-4017
Published: 2021-12-01
Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/star7th/showdoc/commit/654e871a3923e79076818a9a03533fe88222c871; https://huntr.dev/bounties/1d8439e8-b3f7-40f8-8b30-f9cb05ff2bcd; https://github.com/star7th/showdoc/commit/654e871a3923e79076818a9a03533fe88222c871
CVE: CVE-2021-32592
Published: 2021-12-01
Description: An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allow an attacker to perform a DLL Hijack attack on affected devices via a malicious OpenSSL engine library in the search path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://fortiguard.com/advisory/FG-IR-21-088; https://fortiguard.com/advisory/FG-IR-21-088
CVE: CVE-2021-3964
Published: 2021-12-01
Description: elgg is vulnerable to Authorization Bypass Through User-Controlled Key
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-639
References: https://github.com/elgg/elgg/commit/d9fcad76ee380ea17edd61d13d0f87828ea3f744; https://huntr.dev/bounties/a4df45d6-b739-4299-967f-c960b569383a; https://github.com/elgg/elgg/commit/d9fcad76ee380ea17edd61d13d0f87828ea3f744
CVE: CVE-2021-3983
Published: 2021-12-01
Description: kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0; https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413; https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0
CVE: CVE-2021-43690
Published: 2021-12-01
Description: YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. The exit function will terminate the script and print a message which have values from the socket_read.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Yurunsoft/YurunProxy/issues/3; https://github.com/Yurunsoft/YurunProxy/issues/3
CVE: CVE-2021-44280
Published: 2021-12-01
Description: attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44280; https://www.nu11secur1ty.com/2021/12/cve-2021-44280.html; https://www.sourcecodester.com/php/14173/attendance-management-system.html#comment-96757
CVE: CVE-2021-25967
Published: 2021-12-01
Description: In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25967; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25967
CVE: CVE-2021-44277
Published: 2021-12-01
Description: Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/pull/13554; https://github.com/librenms/librenms/pull/13554
CVE: CVE-2021-44279
Published: 2021-12-01
Description: Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/pull/13554; https://github.com/librenms/librenms/pull/13554
CVE: CVE-2021-40154
Published: 2021-12-01
Description: NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125
References: https://github.com/Xen1thLabs-AE/CVE-2021-40154; https://www.darkmatter.ae/xen1thlabs/published-advisories/; https://github.com/Xen1thLabs-AE/CVE-2021-40154
CVE: CVE-2021-43689
Published: 2021-12-01
Description: manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.class.php. The exit function will terminate the script and print a message which have values from $_POST.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yicenburan/manage/issues/2; https://github.com/yicenburan/manage/issues/2
CVE: CVE-2021-44479
Published: 2021-12-01
Description: NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125
References: https://github.com/Xen1thLabs-AE/CVE-2021-40154; https://www.darkmatter.ae/xen1thlabs/published-advisories/; https://github.com/Xen1thLabs-AE/CVE-2021-40154