deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-45097
Published: 2021-12-16
Description: KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content.
CVSS Score: 2.9 (LOW)
CWE: CWE-522
References: https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-weak-file-permission; https://zigrin.com/advisories/knime-server-weak-file-permissions/; https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/KNIME/CVE-weak-file-permission
CVE: CVE-2021-45098
Published: 2021-12-16
Description: An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.
CVSS Score: 7.5 (HIGH)
References: https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942; https://github.com/OISF/suricata/commit/50e2b973eeec7172991bf8f544ab06fb782b97df; https://github.com/OISF/suricata/releases
CVE: CVE-2021-45099
Published: 2021-12-16
Description: The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
CVSS Score: 8.8 (HIGH)
References: https://gist.github.com/Eriner/[PII_REDACTED]f70556d2c26c83439a9f67; https://github.com/hassio-addons/addon-ssh/releases/tag/v10.0.0; https://gist.github.com/Eriner/[PII_REDACTED]f70556d2c26c83439a9f67
CVE: CVE-2021-45100
Published: 2021-12-16
Description: The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. This occurs because it sets the SMB2_GLOBAL_CAP_ENCRYPTION flag when using the SMB 3.1.1 protocol, which is a violation of the SMB protocol specification. When Windows 10 detects this protocol violation, it disables encryption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/cifsd-team/ksmbd/issues/550; https://github.com/cifsd-team/ksmbd/pull/551; https://marc.info/?l=linux-kernel&m=[PII_REDACTED]7023&w=2
CVE: CVE-2021-45101
Published: 2021-12-16
Description: An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users' jobs and/or read their data.
CVSS Score: 8.1 (HIGH)
References: https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003/; https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003/
CVE: CVE-2021-45102
Published: 2021-12-16
Description: An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemon using a SciToken, a user may be granted authorizations beyond what the token should allow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0004/; https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0004/
CVE: CVE-2021-4121
Published: 2021-12-16
Description: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/6b5967198e43b6fbb3b2715b49c6cd5b12ce08c3; https://huntr.dev/bounties/6da878de-acdb-4b97-b9ff-9674c3f0881d; https://github.com/yetiforcecompany/yetiforcecrm/commit/6b5967198e43b6fbb3b2715b49c6cd5b12ce08c3
CVE: CVE-2021-4123
Published: 2021-12-16
Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/livehelperchat/livehelperchat/commit/2a98c69cf8899afb9a76d737527abb1dd96fa106; https://huntr.dev/bounties/52182545-fdd6-4d4f-9fba-25010f7f8cba; https://github.com/livehelperchat/livehelperchat/commit/2a98c69cf8899afb9a76d737527abb1dd96fa106
CVE: CVE-2021-40835
Published: 2021-12-16
Description: An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain, while it comes from another. This is performed by using a very long username part of the url so that user cannot see the domain name. A remote attacker can leverage this to perform url address bar spoofing attack. The fix is, browser no longer shows the user name part in address bar.
CVSS Score: 4.6 (MEDIUM)
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-4124
Published: 2021-12-16
Description: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/meetecho/janus-gateway/commit/f62bba6513ec840761f2434b93168106c7c65a3d; https://huntr.dev/bounties/a6ca142e-60aa-4d6f-b231-5d1bcd1b7190; https://github.com/meetecho/janus-gateway/commit/f62bba6513ec840761f2434b93168106c7c65a3d
CVE: CVE-2021-3959
Published: 2021-12-16
Description: A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone versions prior to 3.3.8.272
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-bitdefender-gravityzone-update-server-in-relay-mode-va-10145; https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-bitdefender-gravityzone-update-server-in-relay-mode-va-10145
CVE: CVE-2021-3960
Published: 2021-12-16
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-10146; https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-10146
CVE: CVE-2021-42912
Published: 2021-12-16
Description: FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://fiberhome.com; http://onu.com; https://medium.com/%40windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2
CVE: CVE-2021-41260
Published: 2021-12-16
Description: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://github.com/galette/galette/commit/a5602bca2566f1be370631c3ab2d40feedd4b3ad; https://github.com/galette/galette/security/advisories/GHSA-hw28-c7px-xqm5; https://github.com/galette/galette/commit/a5602bca2566f1be370631c3ab2d40feedd4b3ad
CVE: CVE-2021-41962
Published: 2021-12-16
Description: Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in a Send Service Request in vehicle_service.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/lohyt/-CVE-2021-41962; https://github.com/lohyt/-CVE-2021-41962
CVE: CVE-2021-37262
Published: 2021-12-16
Description: JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/jflyfox/jfinal_cms/issues/23; https://github.com/jflyfox/jfinal_cms/issues/23
CVE: CVE-2021-38244
Published: 2021-12-16
Description: A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/cBioPortal/cbioportal/issues/8680; https://github.com/cBioPortal/cbioportal/pull/8751; https://github.com/cBioPortal/cbioportal/issues/8680
CVE: CVE-2021-41028
Published: 2021-12-16
Description: A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in FortiClientWindows, FortiClientLinux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol.
CVSS Score: 8.2 (HIGH)
CWE: CWE-295, CWE-798
References: https://fortiguard.com/advisory/FG-IR-21-075; https://fortiguard.com/advisory/FG-IR-21-075
CVE: CVE-2021-41261
Published: 2021-12-16
Description: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been resolved in the 0.9.6 release and all users are advised to upgrade. There are no known workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/galette/galette/commit/0d55bc7f420470e0dbca91ebe7899c592905cbc5; https://github.com/galette/galette/security/advisories/GHSA-28fg-cp22-6c33; https://github.com/galette/galette/commit/0d55bc7f420470e0dbca91ebe7899c592905cbc5
CVE: CVE-2021-41262
Published: 2021-12-16
Description: Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soon as possible. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/galette/galette/commit/8e940641b5ed46c3f471332827df388ea00a85d3; https://github.com/galette/galette/security/advisories/GHSA-936f-xvgq-fg74; https://github.com/galette/galette/commit/8e940641b5ed46c3f471332827df388ea00a85d3
CVE: CVE-2021-42550
Published: 2021-12-16
Description: In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502, CWE-502
References: http://logback.qos.ch/news.html; http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html; http://seclists.org/fulldisclosure/2022/Jul/11
CVE: CVE-2021-43812
Published: 2021-12-16
Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6; https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvp; https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6
CVE: CVE-2021-43837
Published: 2021-12-16
Description: vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix `!template!`, vault-cli interprets the rest of the contents of the secret as a Jinja2 template. Jinja2 is a powerful templating engine and is not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk. If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you. In 3.0.0, the code related to interpreting vault templated secrets has been removed entirely. Users are advised to upgrade as soon as possible. For users unable to upgrade a workaround does exist. Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand, e.g. `vault-cli --no-render get-all`) or adding `render: false` to the vault-cli configuration yaml file disables rendering and removes the vulnerability. Using the python library, you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely.
CVSS Score: 8.4 (HIGH)
CWE: CWE-74, CWE-94
References: https://github.com/peopledoc/vault-cli/commit/3ba3955887fd6b7d4d646c8b260f21cebf5db852; https://github.com/peopledoc/vault-cli/security/advisories/GHSA-q34h-97wf-8r8j; https://podalirius.net/en/publications/grehack-2021-optimizing-ssti-payloads-for-jinja2/
CVE: CVE-2021-44315
Published: 2021-12-16
Description: In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/blob/master/Directory%20listing/Report_Directory%20listing.pdf; https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/tree/master/Directory%20listing; https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/blob/master/Directory%20listing/Report_Directory%20listing.pdf
CVE: CVE-2021-44317
Published: 2021-12-16
Description: In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/blob/master/xss/; https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/blob/master/xss/Report_SXSS.pdf; https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/blob/master/xss/
CVE: CVE-2020-35209
Published: 2021-12-16
Description: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
CVSS Score: 7.5 (HIGH)
References: https://docs.google.com/presentation/d/1W5KU7ffh4dheR8iD54ulABImi6byAhSI-OhEKw2adRo/edit?usp=sharing; https://docs.google.com/presentation/d/1W5KU7ffh4dheR8iD54ulABImi6byAhSI-OhEKw2adRo/edit?usp=sharing
CVE: CVE-2020-35210
Published: 2021-12-16
Description: A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://docs.google.com/presentation/d/1eZznIciFI06_5UJrXvlLugH2-nmjfYpQO5NyNMc9RxU/edit?usp=sharing; https://docs.google.com/presentation/d/1eZznIciFI06_5UJrXvlLugH2-nmjfYpQO5NyNMc9RxU/edit?usp=sharing
CVE: CVE-2020-35211
Published: 2021-12-16
Description: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext.
CVSS Score: 7.5 (HIGH)
References: https://docs.google.com/presentation/d/1C_IpRfSU-9FMezcHCFZ-qg-15JO-W36yvqcnzI8sQs8/edit?usp=sharing; https://docs.google.com/presentation/d/1C_IpRfSU-9FMezcHCFZ-qg-15JO-W36yvqcnzI8sQs8/edit?usp=sharing
CVE: CVE-2020-35213
Published: 2021-12-16
Description: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://docs.google.com/presentation/d/1i8tVVGE8z9Rtl9UTwktOJpkZwT4kBVLgIk307qMiw_8/edit?usp=sharing; https://docs.google.com/presentation/d/1i8tVVGE8z9Rtl9UTwktOJpkZwT4kBVLgIk307qMiw_8/edit?usp=sharing
CVE: CVE-2020-35214
Published: 2021-12-16
Description: An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
CVSS Score: 8.1 (HIGH)
References: https://docs.google.com/presentation/d/1wJi4QJko5ZCdADuzmAG9ed-nQLyJVkLBJf6cylAL71A/edit?usp=sharing; https://docs.google.com/presentation/d/1wJi4QJko5ZCdADuzmAG9ed-nQLyJVkLBJf6cylAL71A/edit?usp=sharing
CVE: CVE-2020-35215
Published: 2021-12-16
Description: An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://docs.google.com/presentation/d/1pRRLfdSUqUZ688CZ9e9AyceuXPGp9oyGj7j4bdSsBcw/edit?usp=sharing; https://docs.google.com/presentation/d/1pRRLfdSUqUZ688CZ9e9AyceuXPGp9oyGj7j4bdSsBcw/edit?usp=sharing
CVE: CVE-2020-35216
Published: 2021-12-16
Description: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://docs.google.com/presentation/d/1woXwR3vciv7ltFan6LyK5vsWXmaUi8ArZonhk80Gr5U/edit?usp=sharing; https://docs.google.com/presentation/d/1woXwR3vciv7ltFan6LyK5vsWXmaUi8ArZonhk80Gr5U/edit?usp=sharing
CVE: CVE-2021-26800
Published: 2021-12-16
Description: Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/Kavisha3/59dac95b268f0d32eab53e659ab59311; https://phpgurukul.com/user-management-system-in-php-using-stored-procedure/; https://gist.github.com/Kavisha3/59dac95b268f0d32eab53e659ab59311
CVE: CVE-2021-3179
Published: 2021-12-16
Description: GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://apps.apple.com/us/app/gglocker/id[PII_REDACTED]#?platform=iphone; https://github.com/ggreco/gglocker/blob/master/gglocker/LoginCheck.m; https://medium.com/%40ksteo11/yet-another-password-manager-app-how-to-better-secure-it-8e9df2ce35c8
CVE: CVE-2021-41843
Published: 2021-12-17
Description: An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165301/OpenEMR-6.0.0-6.1.0-dev-SQL-Injection.html; http://seclists.org/fulldisclosure/2021/Dec/38; https://trovent.github.io/security-advisories/TRSA-2109-01/TRSA-2109-01.txt
CVE: CVE-2021-44857
Published: 2021-12-17
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://phabricator.wikimedia.org/T297322; https://security.gentoo.org/glsa/202305-24; https://www.mediawiki.org/wiki/2021-12_security_release/FAQ
CVE: CVE-2021-45038
Published: 2021-12-17
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://phabricator.wikimedia.org/T297574; https://security.gentoo.org/glsa/202305-24; https://www.mediawiki.org/wiki/2021-12_security_release/FAQ
CVE: CVE-2021-36779
Published: 2021-12-17
Description: A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://bugzilla.suse.com/show_bug.cgi?id=1191818; https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx; https://bugzilla.suse.com/show_bug.cgi?id=1191818
CVE: CVE-2021-36780
Published: 2021-12-17
Description: A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306, CWE-306
References: https://bugzilla.suse.com/show_bug.cgi?id=1191819; https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx; https://bugzilla.suse.com/show_bug.cgi?id=1191819
CVE: CVE-2021-44145
Published: 2021-12-17
Description: In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2021/12/17/1; https://nifi.apache.org/security.html#1.15.1-vulnerabilities; http://www.openwall.com/lists/oss-security/2021/12/17/1
CVE: CVE-2021-43678
Published: 2021-12-17
Description: Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gaoming13/wechat-php-sdk; https://github.com/gaoming13/wechat-php-sdk/issues/30; https://github.com/gaoming13/wechat-php-sdk
CVE: CVE-2021-4132
Published: 2021-12-17
Description: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/55b1e3bf62c564db7c919f5293ec1e755c2958d6; https://huntr.dev/bounties/7eb80e7c-bb7a-478d-9760-0ea2fa9dc0c2; https://github.com/livehelperchat/livehelperchat/commit/55b1e3bf62c564db7c919f5293ec1e755c2958d6