deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-36402
Published: 2021-07-01
Description: Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the OSV "fixed" field but does not have a code change.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26997; https://github.com/ethereum/solidity/commit/c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/solidity/OSV-2020-2131.yaml
CVE: CVE-2020-36403
Published: 2021-07-01
Description: HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yaml; https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c
CVE: CVE-2020-36404
Published: 2021-07-01
Description: Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.
CVSS Score: 7.8 (HIGH)
CWE: CWE-763
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-1506.yaml; https://github.com/keystone-engine/keystone/releases
CVE: CVE-2020-36405
Published: 2021-07-01
Description: Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22850; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-789.yaml; https://github.com/keystone-engine/keystone/releases
CVE: CVE-2020-36406
Published: 2021-07-01
Description: uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's position is that this is "a minor issue or not even an issue at all" because the developer of an application (that uses uWebSockets) should not be allowing the large number of triggered topics to accumulate
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yaml; https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759
CVE: CVE-2020-36407
Published: 2021-07-01
Description: libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24811; https://github.com/AOMediaCodec/libavif/commit/0a8e7244d494ae98e9756355dfbfb6697ded2ff9; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libavif/OSV-2020-1597.yaml
CVE: CVE-2021-36080
Published: 2021-07-01
Description: GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 has a double-free in bit_chain_free (called from dwg_encode_MTEXT and dwg_encode_add_object).
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31724; https://github.com/LibreDWG/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-495.yaml
CVE: CVE-2021-36081
Published: 2021-07-01
Description: Tesseract OCR 5.0.0-alpha-20201231 has a one_ell_conflict use-after-free during a strpbrk call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29698; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/tesseract-ocr/OSV-2021-211.yaml; https://github.com/tesseract-ocr/tesseract/commit/e6f15621c2ab2ecbfabf656942d8ef66f03b2d55
CVE: CVE-2021-36082
Published: 2021-07-01
Description: ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30393; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ndpi/OSV-2021-304.yaml; https://github.com/ntop/nDPI/commit/1ec621c85b9411cc611652fd57a892cfef478af3
CVE: CVE-2021-36083
Published: 2021-07-01
Description: KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33742; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/kimageformats/OSV-2021-695.yaml; https://invent.kde.org/frameworks/kimageformats/commit/297ed9a2fe339bfe36916b9fce628c3242e5be0f
CVE: CVE-2021-36084
Published: 2021-07-01
Description: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31065; https://github.com/SELinuxProject/selinux/commit/f34d3d30c8325e4847a6b696fe7a3936a8a361f3; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-417.yaml
CVE: CVE-2021-36085
Published: 2021-07-01
Description: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31124; https://github.com/SELinuxProject/selinux/commit/2d35fcc7e9e976a2346b1de20e54f8663e8a6cba; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-421.yaml
CVE: CVE-2021-36086
Published: 2021-07-01
Description: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32177; https://github.com/SELinuxProject/selinux/commit/c49a8ea09501ad66e799ea41b8154b6770fec2c8; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-536.yaml
CVE: CVE-2021-36087
Published: 2021-07-01
Description: The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32675; https://github.com/SELinuxProject/selinux/commit/340f0eb7f3673e8aacaf0a96cbfcd4d12a405521; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/selinux/OSV-2021-585.yaml
CVE: CVE-2021-36088
Published: 2021-07-01
Description: Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-415
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33750; https://github.com/fluent/fluent-bit/commit/22346a74c07ceb90296be872be2d53eb92252a54; https://github.com/fluent/fluent-bit/pull/3453
CVE: CVE-2021-36089
Published: 2021-07-01
Description: Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33544; https://github.com/GrokImageCompression/grok/releases; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2021-677.yaml
CVE: CVE-2021-20752
Published: 2021-07-01
Description: Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN15185184/index.html; https://jvn.jp/en/jp/JVN15185184/index.html
CVE: CVE-2021-20778
Published: 2021-07-01
Description: Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN57942445/index.html; https://jvn.jp/en/jp/JVN57942445/index.html; https://www.ec-cube.net/info/weakness/weakness.php?id=80
CVE: CVE-2021-22347
Published: 2021-07-01
Description: There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause temporary DoS.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2020-9158
Published: 2021-07-01
Description: There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS of Samgr.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/1/; https://consumer.huawei.com/en/support/bulletin/2021/1/
CVE: CVE-2021-22343
Published: 2021-07-01
Description: There is a Configuration Defect vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service integrity and availability.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-22344
Published: 2021-07-01
Description: There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause temporary DoS.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2021/5/; https://consumer.huawei.com/en/support/bulletin/2021/5/
CVE: CVE-2021-31813
Published: 2021-07-01
Description: Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://raxis.com/blog/cve-2021-31813; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2021-31813.html; https://raxis.com/blog/cve-2021-31813
CVE: CVE-2021-27477
Published: 2021-07-01
Description: When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PC10P-DP-IO, Plus BUS-EX, Nano 10GX, Nano 2ET,PC10PE, PC10PE-16/16P, PC10E, FL/ET-T-V2H, PC10B,PC10B-P, Nano CPU, PC10P, and PC10GE receive an invalid frame, the outside area of a receive buffer for FL-net are overwritten. As a result, the PLC CPU detects a system error, and the affected products stop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-180-04; https://us-cert.cisa.gov/ics/advisories/icsa-21-180-04
CVE: CVE-2021-35336
Published: 2021-07-01
Description: Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://pratikkhalane91.medium.com/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-tieline-c1ffe3b3757c; https://pratikkhalane91.medium.com/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-tieline-c1ffe3b3757c
CVE: CVE-2021-27660
Published: 2021-07-01
Description: An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-182-02; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://us-cert.cisa.gov/ics/advisories/icsa-21-182-02
CVE: CVE-2021-27661
Published: 2021-07-01
Description: Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-863
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-182-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://us-cert.cisa.gov/ics/advisories/icsa-21-182-01
CVE: CVE-2021-35337
Published: 2021-07-01
Description: Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.exploit-db.com/exploits/50050; https://www.exploit-db.com/exploits/50050
CVE: CVE-2021-28127
Published: 2021-07-01
Description: An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2021-006; https://advisories.stormshield.eu
CVE: CVE-2021-28423
Published: 2021-07-01
Description: Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in edit-subjects-detail.php, edit-teacher-detail.php, or the 'searchdata' POST parameter in search.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://nhattruong.blog/2021/05/22/cve-2021-28423-teachers-record-management-system-1-0-searchdata-error-based-sql-injection-authenticated/; https://packetstormsecurity.com/files/163172/Teachers-Record-Management-System-1.0-SQL-Injection.html; https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
CVE: CVE-2021-28424
Published: 2021-07-01
Description: A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in adminprofile.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://nhattruong.blog/2021/05/22/cve-2021-28424-teachers-record-management-system-1-0-email-stored-cross-site-scripting-xss-vulnerability-authenticated/; https://packetstormsecurity.com/files/163171/Teachers-Record-Management-System-1.0-Cross-Site-Scripting.html; https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
CVE: CVE-2020-27361
Published: 2021-07-01
Description: An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/; https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/
CVE: CVE-2020-27362
Published: 2021-07-01
Description: An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file editor and escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/; https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/
CVE: CVE-2020-4902
Published: 2021-07-01
Description: IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 191045.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191045; https://www.ibm.com/support/pages/node/6468405; https://exchange.xforce.ibmcloud.com/vulnerabilities/191045
CVE: CVE-2020-4935
Published: 2021-07-01
Description: IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191753.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191753; https://www.ibm.com/support/pages/node/6468407; https://exchange.xforce.ibmcloud.com/vulnerabilities/191753
CVE: CVE-2021-32729
Published: 2021-07-01
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading.
CVSS Score: 2.0 (LOW)
CWE: CWE-693, CWE-732
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3; https://jira.xwiki.org/browse/XWIKI-18276; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3
CVE: CVE-2021-32730
Published: 2021-07-01
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d[PII_REDACTED]17a47cc44d32f7257; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v9j2-q4q5-cxh4; https://jira.xwiki.org/browse/XWIKI-18315
CVE: CVE-2021-32731
Published: 2021-07-01
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm; https://jira.xwiki.org/browse/XWIKI-18400
CVE: CVE-2020-23205
Published: 2021-07-01
Description: A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/monstra-cms/monstra/issues/465; https://github.com/monstra-cms/monstra/issues/465
CVE: CVE-2020-23207
Published: 2021-07-01
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values" field under the "Configure Attributes" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/664; https://github.com/phpList/phplist3/issues/664
CVE: CVE-2020-23208
Published: 2021-07-01
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/665; https://github.com/phpList/phplist3/issues/665
CVE: CVE-2020-23209
Published: 2021-07-01
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/666; https://github.com/phpList/phplist3/issues/666
CVE: CVE-2020-23214
Published: 2021-07-01
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/669; https://github.com/phpList/phplist3/issues/669
CVE: CVE-2020-23217
Published: 2021-07-01
Description: A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpList/phplist3/issues/672; https://www.phplist.org/newslist/phplist-3-5-4-release-notes/; https://github.com/phpList/phplist3/issues/672
CVE: CVE-2020-23219
Published: 2021-07-01
Description: Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/monstra-cms/monstra/issues/466; https://github.com/monstra-cms/monstra/issues/466
CVE: CVE-2021-26920
Published: 2021-07-02
Description: In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-610
References: http://www.openwall.com/lists/oss-security/2021/07/02/1; http://www.openwall.com/lists/oss-security/2021/09/24/1; https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3E
CVE: CVE-2021-35042
Published: 2021-07-02
Description: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.djangoproject.com/en/3.2/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y/
CVE: CVE-2021-27412
Published: 2021-07-02
Description: Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03