deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-18476
Published: 2021-08-26
Description: SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/joelister/bug/issues/9; https://github.com/joelister/bug/issues/9
CVE: CVE-2020-18477
Published: 2021-08-26
Description: SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/joelister/bug/issues/8; https://github.com/joelister/bug/issues/8
CVE: CVE-2021-30590
Published: 2021-08-26
Description: Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1227777; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30591
Published: 2021-08-26
Description: Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1229298; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30592
Published: 2021-08-26
Description: Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1209469; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30593
Published: 2021-08-26
Description: Out of bounds read in Tab Strip in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1209616; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30594
Published: 2021-08-26
Description: Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1218468; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30596
Published: 2021-08-26
Description: Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1214481; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30597
Published: 2021-08-26
Description: Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-updated-to.html; https://crbug.com/1232617; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30598
Published: 2021-08-26
Description: Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1234764; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30599
Published: 2021-08-26
Description: Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1234770; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30600
Published: 2021-08-26
Description: Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1231134; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30601
Published: 2021-08-26
Description: Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1234009; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30602
Published: 2021-08-26
Description: Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1230767; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-30603
Published: 2021-08-26
Description: Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://packetstormsecurity.com/files/164259/Chrome-HRTFDatabaseLoader-WaitForLoaderThreadCompletion-Data-Race.html; https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1233564
CVE: CVE-2021-30604
Published: 2021-08-26
Description: Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/08/stable-channel-update-for-desktop.html; https://crbug.com/1234829; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF/
CVE: CVE-2021-36928
Published: 2021-08-26
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36928; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36928
CVE: CVE-2021-36929
Published: 2021-08-26
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 6.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36929; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36929
CVE: CVE-2021-36931
Published: 2021-08-26
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36931; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36931
CVE: CVE-2021-29487
Published: 2021-08-26
Description: octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.
CVSS Score: 7.4 (HIGH)
CWE: CWE-287
References: https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374; https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9; https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5
CVE: CVE-2021-32648
Published: 2021-08-26
Description: octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287
References: https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374; https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9; https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc
CVE: CVE-2021-29715
Published: 2021-08-26
Description: IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks due to open ports. IBM X-Force ID: 201018.
CVSS Score: 9.1 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201018; https://www.ibm.com/support/pages/node/6483653; https://exchange.xforce.ibmcloud.com/vulnerabilities/201018
CVE: CVE-2021-29727
Published: 2021-08-26
Description: IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 201106.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201106; https://www.ibm.com/support/pages/node/6483875; https://exchange.xforce.ibmcloud.com/vulnerabilities/201106
CVE: CVE-2021-29772
Published: 2021-08-26
Description: IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202774; https://www.ibm.com/support/pages/node/6483655; https://exchange.xforce.ibmcloud.com/vulnerabilities/202774
CVE: CVE-2021-29801
Published: 2021-08-26
Description: IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. IBM X-Force ID: 203977.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203977; https://www.ibm.com/support/pages/node/6483875; https://exchange.xforce.ibmcloud.com/vulnerabilities/203977
CVE: CVE-2021-29862
Published: 2021-08-26
Description: IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 206086.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/206086; https://www.ibm.com/support/pages/node/6483875; https://exchange.xforce.ibmcloud.com/vulnerabilities/206086
CVE: CVE-2021-37715
Published: 2021-08-26
Description: A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0. Aruba has released upgrades for the Aruba AirWave Management Platform that address this security vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-015.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-015.txt
CVE: CVE-2021-39161
Published: 2021-08-26
Description: Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-xhmc-9jwm-wqph; https://github.com/discourse/discourse/security/advisories/GHSA-xhmc-9jwm-wqph
CVE: CVE-2021-39165
Published: 2021-08-26
Description: Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-287
References: https://github.com/fiveai/Cachet/commit/27bca[PII_REDACTED]ba80c6fa283d985ddffa84bb6; https://github.com/fiveai/Cachet/security/advisories/GHSA-79mg-4w23-4fqc; https://github.com/fiveai/Cachet/commit/27bca[PII_REDACTED]ba80c6fa283d985ddffa84bb6
CVE: CVE-2020-20675
Published: 2021-08-26
Description: Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://xz.aliyun.com/t/6758#toc-2; https://xz.aliyun.com/t/6758#toc-2
CVE: CVE-2021-39167
Published: 2021-08-27
Description: OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-fg47-3c2x-m2wr
CVE: CVE-2021-39168
Published: 2021-08-27
Description: OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/security/advisories/GHSA-vrw4-w73r-6mm8; https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5
CVE: CVE-2021-40142
Published: 2021-08-27
Description: In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-321292.pdf; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142.pdf; https://opcfoundation.org/security-bulletins/
CVE: CVE-2021-35342
Published: 2021-08-27
Description: The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty; https://northern.tech/our-products; https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty
CVE: CVE-2021-39169
Published: 2021-08-27
Description: Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/misskey-dev/misskey/commit/ec203f7f795766f76b55fecc9248168c1cdf6c99; https://github.com/misskey-dev/misskey/security/advisories/GHSA-pmmv-jwqh-f5ww; https://github.com/misskey-dev/misskey/commit/ec203f7f795766f76b55fecc9248168c1cdf6c99
CVE: CVE-2021-40153
Published: 2021-08-27
Description: squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790; https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646; https://github.com/plougher/squashfs-tools/issues/72
CVE: CVE-2021-29744
Published: 2021-08-27
Description: IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 201694.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201694; https://www.ibm.com/support/pages/node/6484391; https://exchange.xforce.ibmcloud.com/vulnerabilities/201694
CVE: CVE-2021-36530
Published: 2021-08-27
Description: ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffer without checking the boundary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/miniupnp/ngiflib/issues/19; https://github.com/miniupnp/ngiflib/issues/19
CVE: CVE-2021-36531
Published: 2021-08-27
Description: ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer without checking the boundary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/miniupnp/ngiflib/issues/18; https://github.com/miniupnp/ngiflib/issues/18
CVE: CVE-2021-23434
Published: 2021-08-27
Description: This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-843
References: https://github.com/mariocasciaro/object-path%230116; https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb; https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
CVE: CVE-2020-23226
Published: 2021-08-27
Description: Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cacti/cacti/issues/3549; https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html
CVE: CVE-2021-32758
Published: 2021-08-27
Description: OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.
CVSS Score: 7.2 (HIGH)
CWE: CWE-91
References: https://github.com/OpenMage/magento-lts/releases/tag/v19.4.15; https://github.com/OpenMage/magento-lts/releases/tag/v20.0.11; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-26rr-v2j2-25fh
CVE: CVE-2020-18998
Published: 2021-08-27
Description: Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xpleaf/Blog_mini/issues/44; https://github.com/xpleaf/Blog_mini/issues/44
CVE: CVE-2020-18999
Published: 2021-08-27
Description: Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xpleaf/Blog_mini/issues/44; https://github.com/xpleaf/Blog_mini/issues/44
CVE: CVE-2020-19000
Published: 2021-08-27
Description: Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiki/blob/master/simiki/generators.py'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tankywoo/simiki/issues/123; https://github.com/tankywoo/simiki/issues/123
CVE: CVE-2020-19001
Published: 2021-08-27
Description: Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://cwe.mitre.org/data/definitions/77.html; https://github.com/tankywoo/simiki/issues/123; https://cwe.mitre.org/data/definitions/77.html
CVE: CVE-2020-19002
Published: 2021-08-27
Description: Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/stephenmcd/mezzanine/issues/1921; https://github.com/stephenmcd/mezzanine/issues/1921