deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22957
Published: 2021-11-24
Description: A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s account.This vulnerability is fixed in UniFi Protect application Version 1.20.0 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-16
References: https://community.ui.com/releases/Security-Advisory-Bulletin-021-021/62bd8841-6603-4fee-9dba-73037148f173; https://community.ui.com/releases/Security-Advisory-Bulletin-021-021/62bd8841-6603-4fee-9dba-73037148f173
CVE: CVE-2021-41267
Published: 2021-11-24
Description: Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487; https://github.com/symfony/symfony/pull/44243; https://github.com/symfony/symfony/releases/tag/v5.3.12
CVE: CVE-2021-41268
Published: 2021-11-24
Description: Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-384
References: https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc; https://github.com/symfony/symfony/pull/44243; https://github.com/symfony/symfony/releases/tag/v5.3.12
CVE: CVE-2021-41270
Published: 2021-11-24
Description: Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1236
References: https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8; https://github.com/symfony/symfony/pull/44243; https://github.com/symfony/symfony/releases/tag/v5.3.12
CVE: CVE-2021-43778
Published: 2021-11-24
Description: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin; https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46; https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
CVE: CVE-2021-44219
Published: 2021-11-24
Description: Gin-Vue-Admin before 2.4.6 mishandles a SQL database.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/flipped-aurora/gin-vue-admin/issues/813; https://github.com/flipped-aurora/gin-vue-admin/pull/811; https://github.com/flipped-aurora/gin-vue-admin/issues/813
CVE: CVE-2021-44223
Published: 2021-11-25
Description: WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.
CVSS Score: 8.1 (HIGH)
References: https://make.wordpress.org/core/2021/06/29/introducing-update-uri-plugin-header-in-wordpress-5-8/; https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/; https://make.wordpress.org/core/2021/06/29/introducing-update-uri-plugin-header-in-wordpress-5-8/
CVE: CVE-2021-44225
Published: 2021-11-26
Description: In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
CVSS Score: 5.4 (MEDIUM)
References: https://github.com/acassen/keepalived/commit/7977fec0be89ae6fe87405b3f8da2f0b5e415e3d; https://github.com/acassen/keepalived/pull/2063; https://lists.debian.org/debian-lts-announce/2023/04/msg00012.html
CVE: CVE-2021-38685
Published: 2021-11-26
Description: A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-21-51; https://www.qnap.com/en/security-advisory/qsa-21-51
CVE: CVE-2021-38686
Published: 2021-11-26
Description: An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-21-52; https://www.qnap.com/en/security-advisory/qsa-21-52
CVE: CVE-2021-25269
Published: 2021-11-26
Description: A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-428
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-ixa-hmpa-local-dos; https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-ixa-hmpa-local-dos
CVE: CVE-2021-36807
Published: 2021-11-26
Description: An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-sg-sqli; https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-sg-sqli
CVE: CVE-2020-7881
Published: 2021-11-26
Description: The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. It is because of stored data without validation of length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36357; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36357
CVE: CVE-2021-26611
Published: 2021-11-26
Description: HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36359; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36359
CVE: CVE-2021-26615
Published: 2021-11-26
Description: ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36361; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36361
CVE: CVE-2021-35533
Published: 2021-11-26
Description: Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hitachi Energy RTU500 series allows an attacker to cause the receiving RTU500 CMU of which the BCI is enabled to reboot when receiving a specially crafted message. By default, BCI IEC 60870-5-104 function is disabled (not configured). This issue affects: Hitachi Energy RTU500 series CMU Firmware version 12.0.* (all versions); CMU Firmware version 12.2.* (all versions); CMU Firmware version 12.4.* (all versions).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000063&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000063&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-36843
Published: 2021-11-26
Description: Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/floating-social-media-icon/wordpress-floating-social-media-icon-plugin-4-3-5-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/floating-social-media-icon/; https://patchstack.com/database/vulnerability/floating-social-media-icon/wordpress-floating-social-media-icon-plugin-4-3-5-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36919
Published: 2021-11-26
Description: Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-0-6-multiple-authenticated-reflected-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/awesome-support/#developers; https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-0-6-multiple-authenticated-reflected-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2021-40833
Published: 2021-11-26
Description: A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40833; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-41243
Published: 2021-11-26
Description: There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff; https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w; https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff
CVE: CVE-2021-41279
Published: 2021-11-26
Description: BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336; https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg; https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336
CVE: CVE-2021-43776
Published: 2021-11-26
Description: Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49; https://github.com/backstage/backstage/tree/master/plugins/auth-backend; https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49
CVE: CVE-2021-43785
Published: 2021-11-26
Description: @joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16; https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e; https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq
CVE: CVE-2021-23654
Published: 2021-11-26
Description: This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1236
References: https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py; https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784; https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py
CVE: CVE-2021-4020
Published: 2021-11-27
Description: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/meetecho/janus-gateway/commit/d3fc00ec803d6c41d8f98908732f44e7f4911a1c; https://huntr.dev/bounties/9814baa8-7bdd-4e31-a132-d9d15653409e; https://github.com/meetecho/janus-gateway/commit/d3fc00ec803d6c41d8f98908732f44e7f4911a1c
CVE: CVE-2021-44093
Published: 2021-11-28
Description: A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/94fzb/zrlog/issues/115; https://github.com/94fzb/zrlog/issues/115
CVE: CVE-2021-44094
Published: 2021-11-28
Description: ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/94fzb/zrlog/issues/116; https://github.com/94fzb/zrlog/issues/116
CVE: CVE-2021-32061
Published: 2021-11-29
Description: S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/sa7mon/S3Scanner/issues/122; https://github.com/sa7mon/S3Scanner/releases/tag/2.0.2; https://vuln.ryotak.me/advisories/62
CVE: CVE-2021-44077
Published: 2021-11-29
Description: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html; https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above; https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529
CVE: CVE-2021-21707
Published: 2021-11-29
Description: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-159
References: https://bugs.php.net/bug.php?id=79971; https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-8921
Published: 2021-11-29
Description: An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/
CVE: CVE-2019-8922
Published: 2021-11-29
Description: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/
CVE: CVE-2021-38147
Published: 2021-11-29
Description: Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://packetstormsecurity.com/files/165039/Wipro-Holmes-Orchestrator-20.4.1-Report-Disclosure.html; https://www.wipro.com/holmes/; http://packetstormsecurity.com/files/165039/Wipro-Holmes-Orchestrator-20.4.1-Report-Disclosure.html
CVE: CVE-2021-38283
Published: 2021-11-29
Description: Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information via a predictable /log URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://packetstormsecurity.com/files/165031/Wipro-Holmes-Orchestrator-20.4.1-File-Disclosure.html; https://www.wipro.com/holmes/; http://packetstormsecurity.com/files/165031/Wipro-Holmes-Orchestrator-20.4.1-File-Disclosure.html
CVE: CVE-2017-20008
Published: 2021-11-29
Description: The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/1639363/mycred; https://wpscan.com/vulnerability/3175c56d-27bb-4bf1-b6ba-737541483d40; https://plugins.trac.wordpress.org/changeset/1639363/mycred
CVE: CVE-2021-24745
Published: 2021-11-29
Description: The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a965aeca-d8f9-4070-aa0d-9c9b95493dda; https://wpscan.com/vulnerability/a965aeca-d8f9-4070-aa0d-9c9b95493dda
CVE: CVE-2021-24748
Published: 2021-11-29
Description: The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/a8625b84-337d-4c4d-a698-73e59d1f8ee1; https://wpscan.com/vulnerability/a8625b84-337d-4c4d-a698-73e59d1f8ee1
CVE: CVE-2021-24749
Published: 2021-11-29
Description: The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/4b4e417d-0ae2-4c3c-81e6-4dcf39eb5697; https://wpscan.com/vulnerability/4b4e417d-0ae2-4c3c-81e6-4dcf39eb5697