deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1563
Published: 2021-06-04
Description: Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. These vulnerabilities are due to incorrect processing of certain Cisco Discovery Protocol and LLDP packets at ingress time. An attacker could exploit these vulnerabilities by sending crafted Cisco Discovery Protocol or LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DoS condition. Note: Cisco Discovery Protocol and LLDP are Layer 2 protocols. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcamera-lldpcdp-mem-yTQDmjRO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcamera-lldpcdp-mem-yTQDmjRO
CVE: CVE-2021-1564
Published: 2021-06-04
Description: Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. These vulnerabilities are due to incorrect processing of certain Cisco Discovery Protocol and LLDP packets at ingress time. An attacker could exploit these vulnerabilities by sending crafted Cisco Discovery Protocol or LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DoS condition. Note: Cisco Discovery Protocol and LLDP are Layer 2 protocols. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcamera-lldpcdp-mem-yTQDmjRO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcamera-lldpcdp-mem-yTQDmjRO
CVE: CVE-2021-30506
Published: 2021-06-04
Description: Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web application to inject scripts or HTML into a privileged page via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1180126; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30507
Published: 2021-06-04
Description: Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1178202; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30508
Published: 2021-06-04
Description: Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1195340; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30509
Published: 2021-06-04
Description: Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1196309; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30510
Published: 2021-06-04
Description: Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1197436; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30511
Published: 2021-06-04
Description: Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1197875; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30512
Published: 2021-06-04
Description: Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1200019; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30513
Published: 2021-06-04
Description: Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1200490; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30514
Published: 2021-06-04
Description: Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1200766; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30515
Published: 2021-06-04
Description: Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1201073; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30516
Published: 2021-06-04
Description: Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1201446; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30517
Published: 2021-06-04
Description: Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1203122; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30518
Published: 2021-06-04
Description: Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1203590; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30519
Published: 2021-06-04
Description: Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1194058; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2021-30520
Published: 2021-06-04
Description: Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html; https://crbug.com/1193362; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
CVE: CVE-2020-29321
Published: 2021-06-04
Description: The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-798
References: https://cybersecurityworks.com/zerodays/cve-2020-29321-telnet-hardcoded-credentials.html; https://cybersecurityworks.com/zerodays/cve-2020-29321-telnet-hardcoded-credentials.html
CVE: CVE-2020-29322
Published: 2021-06-04
Description: The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-798
References: https://cybersecurityworks.com/zerodays/cve-2020-29322-telnet-hardcoded-credentials.html; https://cybersecurityworks.com/zerodays/cve-2020-29322-telnet-hardcoded-credentials.html
CVE: CVE-2020-29323
Published: 2021-06-04
Description: The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-798
References: https://cybersecurityworks.com/zerodays/cve-2020-29323-telnet-hardcoded-credentials.html; https://cybersecurityworks.com/zerodays/cve-2020-29323-telnet-hardcoded-credentials.html
CVE: CVE-2020-29324
Published: 2021-06-04
Description: The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://cybersecurityworks.com/zerodays/cve-2020-29324-d-link-router-dir-895l-mfc-telnet-hardcoded-credentials.html; https://cybersecurityworks.com/zerodays/cve-2020-29324-d-link-router-dir-895l-mfc-telnet-hardcoded-credentials.html
CVE: CVE-2021-29500
Published: 2021-06-04
Description: bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/fxbin/bubble-fireworks/security/advisories/GHSA-hj36-84cp-29pr; https://github.com/fxbin/bubble-fireworks/security/advisories/GHSA-hj36-84cp-29pr
CVE: CVE-2021-26928
Published: 2021-06-04
Description: BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility; however, Tigera disagrees
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-2; https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-2
CVE: CVE-2021-31249
Published: 2021-06-04
Description: A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31249; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/; https://www.chiyu-tech.com/msg/message-Firmware-update-87.html
CVE: CVE-2021-31250
Published: 2021-06-04
Description: Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31250; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/; https://www.chiyu-tech.com/msg/message-Firmware-update-87.htm
CVE: CVE-2021-31251
Published: 2021-06-04
Description: An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31251; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/#.YLqK1KhKguU; https://www.chiyu-tech.com/msg/message-Firmware-update-87.html
CVE: CVE-2021-31252
Published: 2021-06-04
Description: An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31252; https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks/; https://www.chiyu-tech.com/msg/message-Firmware-update-87.html
CVE: CVE-2021-32641
Published: 2021-06-04
Description: auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7ed; https://github.com/auth0/lock/releases/tag/v11.30.1; https://github.com/auth0/lock/security/advisories/GHSA-jr3j-whm4-9wwm
CVE: CVE-2021-31701
Published: 2021-06-06
Description: Mintty before 3.4.7 mishandles Bracketed Paste Mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://github.com/mintty/mintty/releases/tag/3.4.7; https://github.com/mintty/mintty/releases/tag/3.4.7
CVE: CVE-2021-32198
Published: 2021-06-06
Description: EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
CVSS Score: 9.8 (CRITICAL)
References: http://www.emtec.com/downloads/zoc/zoc_changes.txt; https://pastebin.com/0xhrDvW0; http://www.emtec.com/downloads/zoc/zoc_changes.txt
CVE: CVE-2021-33880
Published: 2021-06-06
Description: The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0; https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpujan2022.html
CVE: CVE-2021-33881
Published: 2021-06-06
Description: On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-863
References: https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html; https://www.nxp.com/docs/en/application-note/AN11340.pdf; https://www.nxp.com/docs/en/application-note/AN13089.pdf
CVE: CVE-2021-33879
Published: 2021-06-06
Description: Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: https://github.com/mmiszczyk/cve-2021-33879; https://www.gameloop.com; https://github.com/mmiszczyk/cve-2021-33879
CVE: CVE-2017-20005
Published: 2021-06-06
Description: NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-120, CWE-190
References: http://nginx.org/en/CHANGES; https://github.com/nginx/nginx/commit/0206ebe76f748bb39d9de4dd4b3fce777fdfdccf; https://github.com/nginx/nginx/commit/b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b
CVE: CVE-2021-33898
Published: 2021-06-06
Description: In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/invoiceninja/invoiceninja/issues/5909; https://github.com/invoiceninja/invoiceninja/issues/5909
CVE: CVE-2020-26885
Published: 2021-06-07
Description: An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://burninatorsec.blogspot.com/2021/04/cve-2020-26885-xss-in-2sxc.html?m=1; https://2SXC.org/en/blog/post/2sxc-security-notification-2021-001; https://burninatorsec.blogspot.com/2020/10/cve-2020-26885-xss-in-anchor-tags.html
CVE: CVE-2021-28382
Published: 2021-06-07
Description: Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://raxis.com/blog/cve-2021-28382; https://www.manageengine.com/key-manager/release-notes.html#6001; https://raxis.com/blog/cve-2021-28382
CVE: CVE-2020-36383
Published: 2021-06-07
Description: PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-affects-over-200000-wordpress-sites/; https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-affects-over-200000-wordpress-sites/
CVE: CVE-2020-36384
Published: 2021-06-07
Description: PageLayer before 1.3.5 allows reflected XSS via color settings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-affects-over-200000-wordpress-sites/; https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-affects-over-200000-wordpress-sites/
CVE: CVE-2021-24336
Published: 2021-06-07
Description: The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-flightlog-sql-injection/; https://wpscan.com/vulnerability/dda0593e-cd97-454e-a8c8-15d7f690311c; https://codevigilant.com/disclosure/2021/wp-plugin-flightlog-sql-injection/
CVE: CVE-2021-24337
Published: 2021-06-07
Description: The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://codevigilant.com/disclosure/2021/wp-plugin-video-embed-box/; https://wpscan.com/vulnerability/a8fd8dd4-5b5e-462e-8dae-065d5e2d003a; https://codevigilant.com/disclosure/2021/wp-plugin-video-embed-box/