deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44433
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains a use after free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14900)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44434
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14902, ZDI-CAN-14866)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44435
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to stack based buffer overflow while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14903)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44436
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14905)
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44437
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14906)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44438
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14907)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44439
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14908)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44440
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to memory corruption condition while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14912)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44441
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14913)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44442
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14995)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44443
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15039)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44444
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15052)
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html
CVE: CVE-2021-44445
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15054)
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44446
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14828, ZDI-CAN-14898)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf
CVE: CVE-2021-44447
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14911)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf
CVE: CVE-2021-44448
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14843, ZDI-CAN-15051)
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf
CVE: CVE-2021-44449
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected products contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14830)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-396621.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-396621.pdf
CVE: CVE-2021-44450
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15055, ZDI-CAN-14915, ZDI-CAN-14865)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-396621.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-396621.pdf
CVE: CVE-2021-44522
Published: 2021-12-14
Description: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf
CVE: CVE-2021-44523
Published: 2021-12-14
Description: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify or delete activity feed entries.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-668
References: https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf
CVE: CVE-2021-44524
Published: 2021-12-14
Description: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf
CVE: CVE-2021-4104
Published: 2021-12-14
Description: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2022/01/18/3; https://access.redhat.com/security/cve/CVE-2021-4104; https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
CVE: CVE-2021-44935
Published: 2021-12-14
Description: glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely without interaction.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-346
References: https://github.com/glFusion/glfusion/issues/482; https://github.com/glFusion/glfusion/issues/482
CVE: CVE-2021-44937
Published: 2021-12-14
Description: glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/glFusion/glfusion/issues/485; https://github.com/glFusion/glfusion/issues/485
CVE: CVE-2021-36721
Published: 2021-12-14
Description: Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server.
CVSS Score: 4.4 (MEDIUM)
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2021-3376
Published: 2021-12-14
Description: An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using the user_group_id_field parameter.
CVSS Score: 8.8 (HIGH)
References: https://github.com/CuppaCMS/CuppaCMS/issues/12; https://github.com/CuppaCMS/CuppaCMS/issues/12
CVE: CVE-2021-44538
Published: 2021-12-14
Description: The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://gitlab.matrix.org/matrix-org/olm/-/tags; https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html; https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk
CVE: CVE-2021-45014
Published: 2021-12-14
Description: There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/taogogo/taocms/issues/11; https://github.com/taogogo/taocms/issues/11
CVE: CVE-2021-45015
Published: 2021-12-14
Description: taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/taogogo/taocms/issues/12; https://github.com/taogogo/taocms/issues/12
CVE: CVE-2021-42050
Published: 2021-12-14
Description: An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/abantecart/abantecart-src/releases; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-abantecart-e-commerce-platform/; https://github.com/abantecart/abantecart-src/releases
CVE: CVE-2021-42051
Published: 2021-12-14
Description: An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an XSS payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/abantecart/abantecart-src/releases; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-abantecart-e-commerce-platform/; https://github.com/abantecart/abantecart-src/releases
CVE: CVE-2021-44949
Published: 2021-12-14
Description: glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://github.com/glFusion/glfusion/issues/487; https://github.com/glFusion/glfusion/issues/487
CVE: CVE-2021-4007
Published: 2021-12-14
Description: Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5629; https://docs.rapid7.com/release-notes/insightagent/20211210/; https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5629
CVE: CVE-2021-4107
Published: 2021-12-14
Description: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/a062d3d5fecb000db207a2ad8a446db97ad96b89; https://huntr.dev/bounties/1d124520-cf29-4539-a0f3-6d041af7b5a8; https://github.com/yetiforcecompany/yetiforcecrm/commit/a062d3d5fecb000db207a2ad8a446db97ad96b89
CVE: CVE-2021-38182
Published: 2021-12-14
Description: Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the cluster.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-116
References: https://github.com/kyma-project/kyma/security/advisories/GHSA-2vjp-5q24-hqjv; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://github.com/kyma-project/kyma/security/advisories/GHSA-2vjp-5q24-hqjv
CVE: CVE-2021-38361
Published: 2021-12-14
Description: The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/htaccess-redirect/trunk/htaccess-redirect.php#L249; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38361; https://plugins.trac.wordpress.org/browser/htaccess-redirect/trunk/htaccess-redirect.php#L249
CVE: CVE-2021-39308
Published: 2021-12-14
Description: The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-myghpay-payment-gateway/trunk/processresponse.php?rev=2410420#L134; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39308; https://plugins.trac.wordpress.org/browser/woo-myghpay-payment-gateway/trunk/processresponse.php?rev=2410420#L134
CVE: CVE-2021-39309
Published: 2021-12-14
Description: The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dump() on $_POST variables found in the ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/parsian-bank-gateway-for-woocommerce/tags/1.0/vendor/dpsoft/parsian-payment/sample/rollback-payment.php#L39; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39309; https://plugins.trac.wordpress.org/browser/parsian-bank-gateway-for-woocommerce/tags/1.0/vendor/dpsoft/parsian-payment/sample/rollback-payment.php#L39
CVE: CVE-2021-39310
Published: 2021-12-14
Description: The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/real-wysiwyg/tags/0.0.2/real-wysiwyg.php#L213; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39310; https://plugins.trac.wordpress.org/browser/real-wysiwyg/tags/0.0.2/real-wysiwyg.php#L213
CVE: CVE-2021-39311
Published: 2021-12-14
Description: The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/link-list-manager/tags/1.0/llm.php#L191; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39311; https://plugins.trac.wordpress.org/browser/link-list-manager/tags/1.0/llm.php#L191
CVE: CVE-2021-39312
Published: 2021-12-14
Description: The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html; https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312