deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8298
Published: 2021-03-04
Description: fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7; https://github.com/pillys/fs-path/pull/6; https://hackerone.com/reports/324491
CVE: CVE-2021-24031
Published: 2021-03-04
Description: In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-277, CWE-276
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404; https://github.com/facebook/zstd/issues/1630; https://www.facebook.com/security/advisories/cve-2021-24031
CVE: CVE-2021-24032
Published: 2021-03-04
Description: Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-277, CWE-276
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519; https://github.com/facebook/zstd/issues/2491; https://www.facebook.com/security/advisories/cve-2021-24032
CVE: CVE-2021-25331
Published: 2021-03-04
Description: Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific condition.
CVSS Score: 3.2 (LOW)
CWE: CWE-200, CWE-200
References: https://security.samsungmobile.com; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25332
Published: 2021-03-04
Description: Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscreen in specific condition.
CVSS Score: 3.2 (LOW)
CWE: CWE-200, CWE-200
References: https://security.samsungmobile.com; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25333
Published: 2021-03-04
Description: Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning specific QR code.
CVSS Score: 3.2 (LOW)
CWE: CWE-200, CWE-200
References: https://security.samsungmobile.com; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25334
Published: 2021-03-04
Description: Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause permanent denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25335
Published: 2021-03-04
Description: Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated users to access hidden notification contents over the lockscreen in specific condition.
CVSS Score: 2.5 (LOW)
CWE: CWE-703
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25336
Published: 2021-03-04
Description: Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to acquire notification access via sending a crafted malicious intent.
CVSS Score: 2.8 (LOW)
CWE: CWE-269
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25337
Published: 2021-03-04
Description: Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25338
Published: 2021-03-04
Description: Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to write certain part of RKP EL2 memory region.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25339
Published: 2021-03-04
Description: Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to corrupt EL2 memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-26293
Published: 2021-03-04
Description: An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://auroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora/; https://auroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora/
CVE: CVE-2021-26988
Published: 2021-03-04
Description: Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to converting a 7-Mode directory to Cluster-mode such as Storage Virtual Machine (SVM) names, volume names, directory paths and Job IDs.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2021-26989
Published: 2021-03-04
Description: Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attacker to cause a Denial of Service (DoS) on clustered Data ONTAP configured for SMB access.
CVSS Score: 6.5 (MEDIUM)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2020-25639
Published: 2021-03-04
Description: A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1876995; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE4CT3NL6OEBRRBUKHIX63GLNVOWCVRW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUCBCKRHWP3UD2AVVYQJE7BIJEMCMXW5/
CVE: CVE-2021-25340
Published: 2021-03-04
Description: Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary settings during Initialization State.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25341
Published: 2021-03-04
Description: Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the provider.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25342
Published: 2021-03-04
Description: Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25343
Published: 2021-03-04
Description: Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows unauthorized actions including denial of service attack by hijacking the provider.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25344
Published: 2021-03-04
Description: Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-862
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25345
Published: 2021-03-04
Description: Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25346
Published: 2021-03-04
Description: A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://www.zerodayinitiative.com/advisories/ZDI-21-342/
CVE: CVE-2021-25347
Published: 2021-03-04
Description: Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25348
Published: 2021-03-04
Description: Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized STORAGE permission.
CVSS Score: 2.1 (LOW)
CWE: CWE-703
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-3403
Published: 2021-03-04
Description: In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a double free which can be triggered via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=1926967; https://github.com/Yeraze/ytnef/issues/85; https://bugzilla.redhat.com/show_bug.cgi?id=1926967
CVE: CVE-2021-3404
Published: 2021-03-04
Description: In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a heap buffer overflow which can be triggered via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1926965; https://github.com/Yeraze/ytnef/issues/86; https://bugzilla.redhat.com/show_bug.cgi?id=1926965
CVE: CVE-2019-18630
Published: 2021-03-04
Description: On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx_v1.2.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx_v1.2.pdf
CVE: CVE-2021-27314
Published: 2021-03-05
Description: SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html; https://packetstormsecurity.com/files/161641/Doctor-Appointment-System-1.0-SQL-Injection.html
CVE: CVE-2019-18351
Published: 2021-03-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-18790. Reason: This candidate is a duplicate of CVE-2019-18790. Notes: All CVE users should reference CVE-2019-18790 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-27963
Published: 2021-03-05
Description: SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous user can send a POST request to /User/saveUser without any authentication or session header.
CVSS Score: 8.2 (HIGH)
CWE: CWE-306
References: https://github.com/erberkan/SonLogger-vulns; https://www.sonlogger.com/releasenotes; https://github.com/erberkan/SonLogger-vulns
CVE: CVE-2021-27964
Published: 2021-03-05
Description: SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/161793/SonLogger-4.2.3.3-Shell-Upload.html; https://github.com/erberkan/SonLogger-vulns; https://www.sonlogger.com/releasenotes
CVE: CVE-2021-27965
Published: 2021-03-05
Description: The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054 IOCTL request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/kronl/cve/tree/master/MSI_Dragon_Center; https://www.microsoft.com/en-us/p/msi-dragon-center/9nh7n2bv1cqq?activetab=pivot:overviewtab; https://github.com/kronl/cve/tree/master/MSI_Dragon_Center
CVE: CVE-2020-36255
Published: 2021-03-05
Description: An issue was discovered in IdentityModel (aka ScottBrady.IdentityModel) before 1.3.0. The Branca implementation allows an attacker to modify and forge authentication tokens.
CVSS Score: 7.5 (HIGH)
References: https://github.com/scottbrady91/IdentityModel/compare/1.2.0...1.3.0; https://github.com/scottbrady91/IdentityModel/issues/3; https://github.com/scottbrady91/IdentityModel/issues/4
CVE: CVE-2020-5148
Published: 2021-03-05
Description: SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-287
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0003; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0003
CVE: CVE-2019-25025
Published: 2021-03-05
Description: The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/rails/activerecord-session_store/pull/151; https://github.com/rails/activerecord-session_store/pull/151
CVE: CVE-2020-29658
Published: 2021-03-05
Description: Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.
CVSS Score: 9.8 (CRITICAL)
References: https://www.manageengine.com/application-control/knowledge-base/privilege-escalation-vulnerability-open-SSL.html; https://www.manageengine.com/application-control/knowledge-base/privilege-escalation-vulnerability-open-SSL.html
CVE: CVE-2021-25313
Published: 2021-03-05
Description: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1181852; https://github.com/rancher/rancher/issues/31583; https://github.com/rancher/rancher/releases/tag/v2.5.6
CVE: CVE-2021-28027
Published: 2021-03-05
Description: An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://rustsec.org/advisories/RUSTSEC-2021-0027.html; https://rustsec.org/advisories/RUSTSEC-2021-0027.html
CVE: CVE-2021-28028
Published: 2021-03-05
Description: An issue was discovered in the toodee crate before 0.3.0 for Rust. Row insertion can cause a double free upon an iterator panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0028.html; https://rustsec.org/advisories/RUSTSEC-2021-0028.html
CVE: CVE-2021-28029
Published: 2021-03-05
Description: An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0028.html; https://rustsec.org/advisories/RUSTSEC-2021-0028.html
CVE: CVE-2021-28030
Published: 2021-03-05
Description: An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0029.html; https://rustsec.org/advisories/RUSTSEC-2021-0029.html
CVE: CVE-2021-28031
Published: 2021-03-05
Description: An issue was discovered in the scratchpad crate before 1.3.1 for Rust. The move_elements function can have a double-free upon a panic in a user-provided f function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0030.html; https://rustsec.org/advisories/RUSTSEC-2021-0030.html
CVE: CVE-2021-28032
Published: 2021-03-05
Description: An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for the same element, if Borrow<Idx> behaves in certain ways. This can have a resultant out-of-bounds write or use-after-free.
CVSS Score: 9.8 (CRITICAL)
References: https://rustsec.org/advisories/RUSTSEC-2021-0031.html; https://rustsec.org/advisories/RUSTSEC-2021-0031.html
CVE: CVE-2021-28033
Published: 2021-03-05
Description: An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0032.html; https://rustsec.org/advisories/RUSTSEC-2021-0032.html
CVE: CVE-2021-28034
Published: 2021-03-05
Description: An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0033.html; https://rustsec.org/advisories/RUSTSEC-2021-0033.html
CVE: CVE-2021-28035
Published: 2021-03-05
Description: An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uninitialized memory can occur upon a val.clone() panic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://rustsec.org/advisories/RUSTSEC-2021-0033.html; https://rustsec.org/advisories/RUSTSEC-2021-0033.html
CVE: CVE-2021-28036
Published: 2021-03-05
Description: An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://rustsec.org/advisories/RUSTSEC-2021-0035.html; https://rustsec.org/advisories/RUSTSEC-2021-0035.html
CVE: CVE-2021-28037
Published: 2021-03-05
Description: An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional implementation of Sync for Intern<T>.
CVSS Score: 9.8 (CRITICAL)
References: https://rustsec.org/advisories/RUSTSEC-2021-0036.html; https://rustsec.org/advisories/RUSTSEC-2021-0036.html
CVE: CVE-2021-20663
Published: 2021-03-05
Description: Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN66542874/index.html; https://movabletype.org/news/2021/02/mt-760-676-released.html; https://jvn.jp/en/jp/JVN66542874/index.html
CVE: CVE-2021-20664
Published: 2021-03-05
Description: Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN66542874/index.html; https://movabletype.org/news/2021/02/mt-760-676-released.html; https://jvn.jp/en/jp/JVN66542874/index.html
CVE: CVE-2021-20665
Published: 2021-03-05
Description: Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN66542874/index.html; https://movabletype.org/news/2021/02/mt-760-676-released.html; https://jvn.jp/en/jp/JVN66542874/index.html