deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39313
Published: 2021-12-14
Description: The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-responsive-image-gallery/tags/1.0.6/simple-image-gallery.php#L420; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39313; https://plugins.trac.wordpress.org/browser/simple-responsive-image-gallery/tags/1.0.6/simple-image-gallery.php#L420
CVE: CVE-2021-39314
Published: 2021-12-14
Description: The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-enviopack/trunk/includes/functions.php?rev=2239846#L605; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39314; https://plugins.trac.wordpress.org/browser/woo-enviopack/trunk/includes/functions.php?rev=2239846#L605
CVE: CVE-2021-39315
Published: 2021-12-14
Description: The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/magic-post-voice/trunk/inc/admin/main.php#L14; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39315; https://plugins.trac.wordpress.org/browser/magic-post-voice/trunk/inc/admin/main.php#L14
CVE: CVE-2021-39318
Published: 2021-12-14
Description: The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/h5p-css-editor/tags/1.0/h5p-css-editor.php#L50; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39318; https://plugins.trac.wordpress.org/browser/h5p-css-editor/tags/1.0/h5p-css-editor.php#L50
CVE: CVE-2021-39319
Published: 2021-12-14
Description: The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/duofaq-responsive-flat-simple-faq/tags/1.4.8/duogeek/duogeek-panel.php#L388; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39319; https://plugins.trac.wordpress.org/browser/duofaq-responsive-flat-simple-faq/tags/1.4.8/duogeek/duogeek-panel.php#L388
CVE: CVE-2021-3836
Published: 2021-12-14
Description: dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/dbeaver/dbeaver/commit/4debf8f25184b7283681ed3fb5e9e887d9d4fe22; https://huntr.dev/bounties/a98264fb-1930-4c7c-b774-af24c0175fd4; https://github.com/dbeaver/dbeaver/commit/4debf8f25184b7283681ed3fb5e9e887d9d4fe22
CVE: CVE-2021-41065
Published: 2021-12-14
Description: An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a session on the Listary installed host. Listary will automatically access the named pipe and the attacker will be able to duplicate the victim's token to impersonate him. This exploit is valid in certain Windows versions (Microsoft has patched the issue in later Windows 10 builds).
CVSS Score: 7.3 (HIGH)
CWE: CWE-668
References: https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e; https://www.listary.com/download; https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
CVE: CVE-2021-41066
Published: 2021-12-14
Description: An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files on the system from Listary itself (it will bypass UAC protection; there is no privilege validation of the current user that runs via Listary).
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e; https://www.listary.com/download; https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
CVE: CVE-2021-41067
Published: 2021-12-14
Description: An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e; https://www.listary.com/download; https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
CVE: CVE-2021-41836
Published: 2021-12-14
Description: The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter found in the ~/fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2641005%40fathom-analytics&new=2641005%40fathom-analytics&sfp_email=&sfph_mail=; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-41836; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2641005%40fathom-analytics&new=2641005%40fathom-analytics&sfp_email=&sfph_mail=
CVE: CVE-2021-42061
Published: 2021-12-14
Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3103677; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3103677
CVE: CVE-2021-42063
Published: 2021-12-14
Description: A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166369/SAP-Knowledge-Warehouse-7.50-7.40-7.31-7.30-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2022/Mar/32; https://launchpad.support.sap.com/#/notes/3102769
CVE: CVE-2021-42064
Published: 2021-12-14
Description: If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://launchpad.support.sap.com/#/notes/3114134; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3114134
CVE: CVE-2021-42066
Published: 2021-12-14
Description: SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but once exploited the attacker may be able to completely compromise confidentiality, integrity, and availability of the application.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://launchpad.support.sap.com/#/notes/3101299; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035; https://launchpad.support.sap.com/#/notes/3101299
CVE: CVE-2021-42068
Published: 2021-12-14
Description: When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3121165; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3121165
CVE: CVE-2021-42069
Published: 2021-12-14
Description: When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application
CVSS Score: 3.3 (LOW)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3121165; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://www.zerodayinitiative.com/advisories/ZDI-21-1551/
CVE: CVE-2021-42070
Published: 2021-12-14
Description: When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3121165; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3121165
CVE: CVE-2021-42367
Published: 2021-12-14
Description: The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-862, CWE-79, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634227%40variation-swatches-for-woocommerce&new=2634227%40variation-swatches-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42367; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634227%40variation-swatches-for-woocommerce&new=2634227%40variation-swatches-for-woocommerce&sfp_email=&sfph_mail=
CVE: CVE-2021-44231
Published: 2021-12-14
Description: Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/3119365; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3119365
CVE: CVE-2021-44232
Published: 2021-12-14
Description: SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://launchpad.support.sap.com/#/notes/3124094; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3124094
CVE: CVE-2021-44233
Published: 2021-12-14
Description: SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3080816; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3080816
CVE: CVE-2021-44235
Published: 2021-12-14
Description: Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the operating system, that could highly impact the Confidentiality, Integrity and Availability of the system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://launchpad.support.sap.com/#/notes/3123196; https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021; https://launchpad.support.sap.com/#/notes/3123196
CVE: CVE-2021-44549
Published: 2021-12-14
Description: Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f; https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f
CVE: CVE-2021-4073
Published: 2021-12-14
Description: The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://plugins.trac.wordpress.org/changeset/2635173/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_user_services.php; https://www.wordfence.com/blog/2021/12/authentication-bypass-vulnerability-patched-in-user-registration-plugin/; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4073
CVE: CVE-2021-38950
Published: 2021-12-14
Description: IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211404; https://www.ibm.com/support/pages/node/6525810; https://exchange.xforce.ibmcloud.com/vulnerabilities/211404
CVE: CVE-2021-40882
Published: 2021-12-14
Description: A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/issues/1477; https://github.com/Piwigo/Piwigo/issues/1477
CVE: CVE-2021-43388
Published: 2021-12-14
Description: Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=65; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=65
CVE: CVE-2021-43807
Published: 2021-12-14
Description: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. The vulnerability allows attackers to craft links or forms which may change the server state. This issue is fixed in Opencast 9.10 and 10.0. You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://github.com/opencast/opencast/commit/59cb[PII_REDACTED]e54f15462be38b6117d8b9ea8b#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8; https://github.com/opencast/opencast/commit/8f8271e1085f6f8e306c689d6a56b0bb8d076444; https://github.com/opencast/opencast/security/advisories/GHSA-j4mm-7pj3-jf7v
CVE: CVE-2021-44041
Published: 2021-12-14
Description: UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-610
References: https://docs.uipath.com/robot/docs/release-notes-2021-10-4; https://docs.uipath.com/robot/docs/uipath-assistant; https://docs.uipath.com/robot/docs/release-notes-2021-10-4
CVE: CVE-2021-44042
Published: 2021-12-14
Description: An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://docs.uipath.com/robot/docs/release-notes-2021-10-4; https://docs.uipath.com/robot/docs/uipath-assistant; https://docs.uipath.com/robot/docs/release-notes-2021-10-4
CVE: CVE-2021-44043
Published: 2021-12-14
Description: An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.uipath.com/apps/v2021.10/docs/2021-10-1; https://docs.uipath.com/robot/docs/uipath-assistant; https://docs.uipath.com/apps/v2021.10/docs/2021-10-1
CVE: CVE-2018-10228
Published: 2021-12-14
Description: Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://limesurvey.com; http://limesurvey.com
CVE: CVE-2021-40883
Published: 2021-12-14
Description: A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/emlog/emlog/issues/108; https://github.com/emlog/emlog/issues/108
CVE: CVE-2021-43820
Published: 2021-12-14
Description: Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.
CVSS Score: 7.4 (HIGH)
CWE: CWE-639
References: https://github.com/haiwen/seafile-server/pull/520; https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8; https://github.com/haiwen/seafile-server/pull/520
CVE: CVE-2021-45046
Published: 2021-12-14
Description: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-917, CWE-917
References: http://www.openwall.com/lists/oss-security/2021/12/14/4; http://www.openwall.com/lists/oss-security/2021/12/15/3; http://www.openwall.com/lists/oss-security/2021/12/18/1