deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-30614
Published: 2021-09-03
Description: Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30614; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30615
Published: 2021-09-03
Description: Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30615; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30616
Published: 2021-09-03
Description: Chromium: CVE-2021-30616 Use after free in Media
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30616; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30617
Published: 2021-09-03
Description: Chromium: CVE-2021-30617 Policy bypass in Blink
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30617; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30618
Published: 2021-09-03
Description: Chromium: CVE-2021-30618 Inappropriate implementation in DevTools
CVSS Score: 8.8 (HIGH)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30618; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30619
Published: 2021-09-03
Description: Chromium: CVE-2021-30619 UI Spoofing in Autofill
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30619; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30620
Published: 2021-09-03
Description: Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink
CVSS Score: 8.8 (HIGH)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30620; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30621
Published: 2021-09-03
Description: Chromium: CVE-2021-30621 UI Spoofing in Autofill
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30621; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30622
Published: 2021-09-03
Description: Chromium: CVE-2021-30622 Use after free in WebApp Installs
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30622; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30623
Published: 2021-09-03
Description: Chromium: CVE-2021-30623 Use after free in Bookmarks
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30623; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-30624
Published: 2021-09-03
Description: Chromium: CVE-2021-30624 Use after free in Autofill
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-30624; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6/
CVE: CVE-2021-40509
Published: 2021-09-04
Description: ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/164045/jforum-2.7.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Sep/13; https://lists.openwall.net/full-disclosure/2021/09/03/7
CVE: CVE-2021-23439
Published: 2021-09-05
Description: This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/johndatserakis/file-upload-with-preview/blob/develop/src/file-upload-with-preview.js%23L168; https://github.com/johndatserakis/file-upload-with-preview/pull/40/files?file-filters%5B%5D=.js&hide-deleted-files=true%23diff-fe47b243de17419c0daa22cd785cd754baed60cf3679d3da1d6fe006f9f4a7f0R174; https://snyk.io/vuln/SNYK-JS-FILEUPLOADWITHPREVIEW-1579492
CVE: CVE-2021-40516
Published: 2021-09-05
Description: WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/weechat/weechat/commit/8b1331f98de1714bae15a9ca2e2b393ba49d735b; https://lists.debian.org/debian-lts-announce/2021/09/msg00018.html; https://weechat.org/doc/security/
CVE: CVE-2021-40523
Published: 2021-09-05
Description: In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of service. Specifically, a server sometimes sends no response, because a fixed buffer space is available for all responses and that space may have been exhausted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/contiki-os/contiki/issues/2686; https://github.com/contiki-os/contiki/issues/2686
CVE: CVE-2021-40524
Published: 2021-09-05
Description: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/jedisct1/pure-ftpd/commit/37ad222868e52271905b94afea4fc780d83294b4; https://github.com/jedisct1/pure-ftpd/compare/1.0.49...1.0.50; https://github.com/jedisct1/pure-ftpd/pull/158
CVE: CVE-2021-24303
Published: 2021-09-06
Description: The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ja9er/CVEProject/blob/main/wordpress_jiangqie-official-website-mini-program_sqli.md; https://wpscan.com/vulnerability/cbd65b7d-d3c3-4ee3-8e5e-ff0eeeaa7b30; https://github.com/ja9er/CVEProject/blob/main/wordpress_jiangqie-official-website-mini-program_sqli.md
CVE: CVE-2021-24390
Published: 2021-09-06
Description: A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-alipay/; https://wpscan.com/vulnerability/92b0abec-082f-4545-9636-1b2f4dac66fe; https://codevigilant.com/disclosure/2021/wp-plugin-alipay/
CVE: CVE-2021-24391
Published: 2021-09-06
Description: An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-cashtomer/; https://wpscan.com/vulnerability/0c26ee50-df3d-438a-93bb-faa88b7983af; https://codevigilant.com/disclosure/2021/wp-plugin-cashtomer/
CVE: CVE-2021-24392
Published: 2021-09-06
Description: An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-club-management-software/; https://wpscan.com/vulnerability/68530e63-bba3-4a9a-ae83-516684aa5dc6; https://codevigilant.com/disclosure/2021/wp-plugin-club-management-software/
CVE: CVE-2021-24393
Published: 2021-09-06
Description: A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-comment-highlighter/; https://wpscan.com/vulnerability/24969766-19e3-47cd-b32c-6c3330651d1f; https://codevigilant.com/disclosure/2021/wp-plugin-comment-highlighter/
CVE: CVE-2021-24394
Published: 2021-09-06
Description: An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-easy-testimonial-manager/; https://wpscan.com/vulnerability/e0bc9251-cccc-4416-91b2-8395d89d8fb3; https://codevigilant.com/disclosure/2021/wp-plugin-easy-testimonial-manager/
CVE: CVE-2021-24395
Published: 2021-09-06
Description: The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-embed-youtube-video/; https://wpscan.com/vulnerability/6cd9ebcf-e78f-4f97-a8f9-b7e4ceab66b7; https://codevigilant.com/disclosure/2021/wp-plugin-embed-youtube-video/
CVE: CVE-2021-24435
Published: 2021-09-06
Description: The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8; https://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8
CVE: CVE-2021-24513
Published: 2021-09-06
Description: The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a1dc0ea9-51dd-43c3-bfd9-c5106193aeb6; https://wpscan.com/vulnerability/a1dc0ea9-51dd-43c3-bfd9-c5106193aeb6
CVE: CVE-2021-24517
Published: 2021-09-06
Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f440edd8-94fe-440a-8a5b-e3d24dcfcbc1; https://wpscan.com/vulnerability/f440edd8-94fe-440a-8a5b-e3d24dcfcbc1
CVE: CVE-2021-24568
Published: 2021-09-06
Description: The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cf7c0207-adb2-44c6-9469-2b24dbfec83a; https://wpscan.com/vulnerability/cf7c0207-adb2-44c6-9469-2b24dbfec83a
CVE: CVE-2021-24588
Published: 2021-09-06
Description: The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dc2ce546-9da1-442c-8ee2-cd660634501f; https://wpscan.com/vulnerability/dc2ce546-9da1-442c-8ee2-cd660634501f
CVE: CVE-2021-24590
Published: 2021-09-06
Description: The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/d6[PII_REDACTED]-4c8d-bb64-af0d8c46e6e7; https://wpscan.com/vulnerability/d6[PII_REDACTED]-4c8d-bb64-af0d8c46e6e7
CVE: CVE-2021-24591
Published: 2021-09-06
Description: The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c5cbe3b4-2829-4fd2-8194-4b3a2ae0e257; https://wpscan.com/vulnerability/c5cbe3b4-2829-4fd2-8194-4b3a2ae0e257
CVE: CVE-2021-24599
Published: 2021-09-06
Description: The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/625a272f-5c69-4f6a-8eee-32f70cd4a558; https://wpscan.com/vulnerability/625a272f-5c69-4f6a-8eee-32f70cd4a558
CVE: CVE-2021-24601
Published: 2021-09-06
Description: The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bb437706-a918-4d66-b027-b083ab486074; https://wpscan.com/vulnerability/bb437706-a918-4d66-b027-b083ab486074
CVE: CVE-2021-24603
Published: 2021-09-06
Description: The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/72aea0e5-1fa7-4827-a[PII_REDACTED]2d323; https://wpscan.com/vulnerability/72aea0e5-1fa7-4827-a[PII_REDACTED]2d323
CVE: CVE-2021-24611
Published: 2021-09-06
Description: The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/b4a2e595-6971-4a2a-a346-ac4445a5e0cd; https://wpscan.com/vulnerability/b4a2e595-6971-4a2a-a346-ac4445a5e0cd
CVE: CVE-2021-25735
Published: 2021-09-06
Description: A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-372
References: https://github.com/kubernetes/kubernetes/issues/100096; https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y; https://github.com/kubernetes/kubernetes/issues/100096
CVE: CVE-2021-25737
Published: 2021-09-06
Description: A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
CVSS Score: 2.7 (LOW)
CWE: CWE-184, CWE-601
References: https://github.com/kubernetes/kubernetes/issues/102106; https://groups.google.com/g/kubernetes-security-announce/c/xAiN3924thY; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-32568
Published: 2021-09-06
Description: mrdoc is vulnerable to Deserialization of Untrusted Data
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/zmister2016/mrdoc/commit/bb49e1287700b4e7681eab544c61093821ce72f6; https://huntr.dev/bounties/04fc04b3-2dc1-4cad-a090-e403cd66b5ad; https://github.com/zmister2016/mrdoc/commit/bb49e1287700b4e7681eab544c61093821ce72f6
CVE: CVE-2021-36744
Published: 2021-09-06
Description: Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the system to escalate privileges and create a denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://helpcenter.trendmicro.com/en-us/article/tmka-10568; https://www.zerodayinitiative.com/advisories/ZDI-21-1052/; https://helpcenter.trendmicro.com/en-us/article/tmka-10568
CVE: CVE-2021-3766
Published: 2021-09-06
Description: objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9; https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc; https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
CVE: CVE-2021-3767
Published: 2021-09-06
Description: bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/bookstackapp/bookstack/commit/040997fdc4414776bcac06a3cbaac3b26b5e8a64; https://huntr.dev/bounties/7ec92c85-30eb-4071-8[PII_REDACTED]ca980; https://github.com/bookstackapp/bookstack/commit/040997fdc4414776bcac06a3cbaac3b26b5e8a64
CVE: CVE-2021-3768
Published: 2021-09-06
Description: bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/bookstackapp/bookstack/commit/5e6092aaf8fd[PII_REDACTED][PII_REDACTED]0bf8ea64; https://huntr.dev/bounties/64a0229f-ff5e-4c64-b83e-9bfc0698a78e; https://github.com/bookstackapp/bookstack/commit/5e6092aaf8fd[PII_REDACTED][PII_REDACTED]0bf8ea64
CVE: CVE-2021-3770
Published: 2021-09-06
Description: vim is vulnerable to Heap-based Buffer Overflow
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2021/10/01/1; https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9; https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365
CVE: CVE-2021-36093
Published: 2021-09-06
Description: It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-185
References: https://otrs.com/release-notes/otrs-security-advisory-2021-16/; https://otrs.com/release-notes/otrs-security-advisory-2021-16/
CVE: CVE-2021-36094
Published: 2021-09-06
Description: It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2021-17/; https://otrs.com/release-notes/otrs-security-advisory-2021-17/
CVE: CVE-2021-36095
Published: 2021-09-06
Description: Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-640
References: https://otrs.com/release-notes/otrs-security-advisory-2021-18/; https://otrs.com/release-notes/otrs-security-advisory-2021-18/
CVE: CVE-2021-36096
Published: 2021-09-06
Description: Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://otrs.com/release-notes/otrs-security-advisory-2021-10/; https://otrs.com/release-notes/otrs-security-advisory-2021-10/
CVE: CVE-2020-15939
Published: 2021-09-06
Description: An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL.
CVSS Score: 4.3 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-20-071; https://fortiguard.com/advisory/FG-IR-20-071
CVE: CVE-2021-24006
Published: 2021-09-06
Description: An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL.
CVSS Score: 6.3 (MEDIUM)
References: https://fortiguard.com/advisory/FG-IR-20-061; https://fortiguard.com/advisory/FG-IR-20-061