deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1584
Published: 2021-08-25
Description: A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during the execution of a specific CLI command. An attacker with administrative privileges could exploit this vulnerability by performing a command injection attack on the vulnerable command. A successful exploit could allow the attacker to access the underlying operating system as root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-naci-mdvul-vrKVgNU; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-naci-mdvul-vrKVgNU
CVE: CVE-2021-1586
Published: 2021-08-25
Description: A vulnerability in the Multi-Pod or Multi-Site network configurations for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to unexpectedly restart the device, resulting in a denial of service (DoS) condition. This vulnerability exists because TCP traffic sent to a specific port on an affected device is not properly sanitized. An attacker could exploit this vulnerability by sending crafted TCP data to a specific port that is listening on a public-facing IP address for the Multi-Pod or Multi-Site configuration. A successful exploit could allow the attacker to cause the device to restart unexpectedly, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-345, CWE-345
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9kaci-tcp-dos-YXukt6gM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9kaci-tcp-dos-YXukt6gM
CVE: CVE-2021-1587
Published: 2021-08-25
Description: A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific packets with a Transparent Interconnection of Lots of Links (TRILL) OAM EtherType. An attacker could exploit this vulnerability by sending crafted packets, including the TRILL OAM EtherType of 0x8902, to a device that is part of a VXLAN Ethernet VPN (EVPN) fabric. A successful exploit could allow the attacker to cause an affected device to experience high CPU usage and consume excessive system resources, which may result in overall control plane instability and cause the affected device to reload. Note: The NGOAM feature is disabled by default.
CVSS Score: 8.6 (HIGH)
CWE: CWE-115, CWE-436
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ngoam-dos-LTDb9Hv; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ngoam-dos-LTDb9Hv
CVE: CVE-2021-1588
Published: 2021-08-25
Description: A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input validation when an affected device is processing an MPLS echo-request or echo-reply packet. An attacker could exploit this vulnerability by sending malicious MPLS echo-request or echo-reply packets to an interface that is enabled for MPLS forwarding on the affected device. A successful exploit could allow the attacker to cause the MPLS OAM process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-126, CWE-20, CWE-125
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mpls-oam-dos-sGO9x5GM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mpls-oam-dos-sGO9x5GM
CVE: CVE-2021-1590
Published: 2021-08-25
Description: A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service (DoS) condition. This vulnerability is due to a logic error in the implementation of the system login block-for command when an attack is detected and acted upon. An attacker could exploit this vulnerability by performing a brute-force login attack on an affected device. A successful exploit could allow the attacker to cause a login process to reload, which could result in a delay during authentication to the affected device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-login-blockfor-RwjGVEcu; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-login-blockfor-RwjGVEcu
CVE: CVE-2021-1591
Published: 2021-08-25
Description: A vulnerability in the EtherChannel port subscription logic of Cisco Nexus 9500 Series Switches could allow an unauthenticated, remote attacker to bypass access control list (ACL) rules that are configured on an affected device. This vulnerability is due to oversubscription of resources that occurs when applying ACLs to port channel interfaces. An attacker could exploit this vulnerability by attempting to access network resources that are protected by the ACL. A successful exploit could allow the attacker to access network resources that would be protected by the ACL that was applied on the port channel interface.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nexus-acl-vrvQYPVe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nexus-acl-vrvQYPVe
CVE: CVE-2021-1592
Published: 2021-08-25
Description: A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management for established SSH sessions. An attacker could exploit this vulnerability by opening a significant number of SSH sessions on an affected device. A successful exploit could allow the attacker to cause a crash and restart of internal Cisco UCS Manager software processes and a temporary loss of access to the Cisco UCS Manager CLI and web UI. Note: The attacker must have valid user credentials to authenticate to the affected device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-664, CWE-770
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-ssh-dos-MgvmyrQy; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-ssh-dos-MgvmyrQy
CVE: CVE-2021-28070
Published: 2021-08-25
Description: Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/PopojiCMS/PopojiCMS/issues/31; https://github.com/PopojiCMS/PopojiCMS/issues/31
CVE: CVE-2021-37153
Published: 2021-08-25
Description: ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.
CVSS Score: 9.8 (CRITICAL)
References: https://backstage.forgerock.com/knowledge/kb/article/a55763454; https://www.forgerock.com/platform/access-management; https://backstage.forgerock.com/knowledge/kb/article/a55763454
CVE: CVE-2021-37154
Published: 2021-08-25
Description: In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: https://backstage.forgerock.com/knowledge/kb/article/a55763454; https://www.forgerock.com/platform/access-management; https://backstage.forgerock.com/knowledge/kb/article/a55763454
CVE: CVE-2021-37334
Published: 2021-08-25
Description: Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a temporary directory. By default, files are stored within the application directory structure at %BASEDIR%/APP_DATA/TEMP/FileUploads/. Whilst access to this directory is restricted by the root web.config file, it is possible to override this restriction by uploading another specially crafted web.config file to the temporary directory. It is possible to exploit this flaw to upload a malicious script file to execute arbitrary code and system commands on the server.
CVSS Score: 9.8 (CRITICAL)
References: https://umbraco.com/blog/security-advisory-20th-of-july-2021-patch-is-now-available/; https://umbraco.com/blog/security-advisory-security-patches-for-umbraco-forms-ready-on-july-20th-2021-at-7-am-utc/; https://umbraco.com/blog/security-advisory-20th-of-july-2021-patch-is-now-available/
CVE: CVE-2021-40145
Published: 2021-08-26
Description: gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://github.com/libgd/libgd/commit/c5fd25ce0e48fd5618a972ca9f5e28d6d62006af; https://github.com/libgd/libgd/issues/700; https://github.com/libgd/libgd/pull/713
CVE: CVE-2021-20793
Published: 2021-08-26
Description: Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN80288258/index.html; https://www.sony.co.uk/electronics/support/software/00266642; https://www.sony.co.uk/electronics/support/software/00266749
CVE: CVE-2021-20808
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20809
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20810
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20811
Published: 2021-08-26
Description: Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20812
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20813
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20814
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2021-20815
Published: 2021-08-26
Description: Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN97545738/index.html; https://movabletype.org/news/2021/08/mt-780-681-released.html; https://jvn.jp/en/jp/JVN97545738/index.html
CVE: CVE-2020-19703
Published: 2021-08-26
Description: A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zyx0814/dzzoffice/issues/107; https://github.com/zyx0814/dzzoffice/issues/107
CVE: CVE-2020-19704
Published: 2021-08-26
Description: A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sail-y/spring-boot-admin/issues/7; https://github.com/sail-y/spring-boot-admin/issues/7
CVE: CVE-2020-19705
Published: 2021-08-26
Description: thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jorycn/thinkphp-zcms/issues/2; https://github.com/jorycn/thinkphp-zcms/issues/2
CVE: CVE-2020-19709
Published: 2021-08-26
Description: Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/liufee/feehicms/issues/2; https://github.com/liufee/feehicms/issues/2
CVE: CVE-2020-19821
Published: 2021-08-26
Description: A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/millken/doyocms/issues/3; https://github.com/millken/doyocms/issues/3
CVE: CVE-2020-19822
Published: 2021-08-26
Description: A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://cwe.mitre.org/data/definitions/96.html; https://github.com/seabird1992/TEST123/blob/master/[PII_REDACTED]68_0zzcms.pdf; https://cwe.mitre.org/data/definitions/96.html
CVE: CVE-2020-14160
Published: 2021-08-26
Description: An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/gotenberg/gotenberg/issues/215; https://github.com/gotenberg/gotenberg/pull/319; https://github.com/thecodingmachine/gotenberg/releases
CVE: CVE-2020-14161
Published: 2021-08-26
Description: It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gotenberg/gotenberg/issues/215; https://github.com/gotenberg/gotenberg/pull/319; https://github.com/thecodingmachine/gotenberg/releases
CVE: CVE-2021-27944
Published: 2021-08-26
Description: Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threat actor to access privileged functionality, leading to OS command execution. The specific attack methodology is a file upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.l9group.com/advisories/vizio-tv-unauthenticated-remote-code-execution; https://www.vizio.com; https://www.l9group.com/advisories/vizio-tv-unauthenticated-remote-code-execution
CVE: CVE-2021-38559
Published: 2021-08-26
Description: DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://vitthals.github.io/writeups/CVEs/Hoteldruid%203.0.2%20XSS; https://www.hoteldruid.com; https://vitthals.github.io/writeups/CVEs/Hoteldruid%203.0.2%20XSS
CVE: CVE-2021-3734
Published: 2021-08-26
Description: yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
CVSS Score: 8.8 (HIGH)
CWE: CWE-1021, CWE-352, CWE-1021
References: https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe; https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd; https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe
CVE: CVE-2021-36352
Published: 2021-08-26
Description: Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registration_admission/patient_register.php page with "name_middle", "addr_str", "station", "name_maiden", "name_2", "name_3" parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36352; https://www.exploit-db.com/exploits/50197; https://securityforeveryone.com/blog/care2x-hospital-information-management-system-0-day-vulnerability-cve-2021-36352
CVE: CVE-2021-32076
Published: 2021-08-26
Description: Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076; https://exchange.xforce.ibmcloud.com/vulnerabilities/208278; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076
CVE: CVE-2021-40147
Published: 2021-08-26
Description: EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.
CVSS Score: 9.8 (CRITICAL)
References: http://www.emtec.com/downloads/zoc/zoc_changes.txt; http://www.emtec.com/downloads/zoc/zoc_changes.txt
CVE: CVE-2020-18467
Published: 2021-08-26
Description: Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigtreecms/BigTree-CMS/issues/364; https://github.com/bigtreecms/BigTree-CMS/issues/364
CVE: CVE-2020-18468
Published: 2021-08-26
Description: Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/2; https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/2
CVE: CVE-2020-18469
Published: 2021-08-26
Description: Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to /rukovoditel_2.4.1/index.php?module=configuration/save&redirect_to=configuration/application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3; https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/5; https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3
CVE: CVE-2020-18470
Published: 2021-08-26
Description: Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to rukovoditel_2.4.1/install/index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3; https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/4; https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3
CVE: CVE-2020-18475
Published: 2021-08-26
Description: Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email, the malicious code will be executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/joelister/bug/issues/7; https://github.com/joelister/bug/issues/7