rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-25085 WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting
The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WOOF – Products Filter for WooCommerce
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:36.000Z
CVE-2021-25086 Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Page Visit Counter – Advanced WordPress Visit Counter
Credits: lang: en
value: Krzysztof Zając
Published: 2022-05-02T16:05:31.000Z
CVE-2021-25087 Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure
The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Download Manager
Credits: lang: en
value: Diogo Real
Published: 2022-03-07T08:16:18.000Z
CVE-2021-25088 Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting
The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: XML Sitemaps
Credits: lang: en
value: JrXnm
Published: 2022-06-20T10:25:40.000Z
CVE-2021-25089 UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: UpdraftPlus WordPress Backup Plugin
Credits: lang: en
value: JrXnm
Published: 2022-02-01T12:21:37.000Z
CVE-2021-25090 GridKit Portfolio < 2.1.0 - Subscriber+ Stored Cross-Site Scripting
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Portfolio Gallery, Product Catalog – Grid KIT Portfolio
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-11T14:40:38.000Z
CVE-2021-25091 Link Library < 7.2.9 - Reflected Cross-Site Scripting
The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Link Library
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:38.000Z
CVE-2021-25092 Link Library < 7.2.8 - Library Settings Reset via CSRF
The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Link Library
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:39.000Z
CVE-2021-25093 Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion
The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Link Library
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:39.000Z
CVE-2021-25094 Tatsu < 3.3.12 - Unauthenticated RCE
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Unknown
product: Tatsu
Credits: lang: en
value: Vincent MICHEL
Published: 2022-04-25T15:50:46.000Z
CVE-2021-25095 IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: IP2Location Country Blocker
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T00:00:00.000Z
CVE-2021-25096 IP2Location Country Blocker < 2.26.5 - Ban Bypass
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: IP2Location Country Blocker
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:20.000Z
CVE-2021-25097 LabTools <= 1.0 - Subscriber+ Arbitrary Publication Deletion
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: LabTools
Credits: lang: en
value: Muhammad Adel
Published: 2022-02-01T00:00:00.000Z
CVE-2021-25098 Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF
The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Pricing Tables WordPress Plugin – Easy Pricing Tables
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:20.000Z
CVE-2021-25099 Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: GiveWP – Donation Plugin and Fundraising Platform
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:45:53.000Z
CVE-2021-25100 Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: GiveWP – Donation Plugin and Fundraising Platform
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:45:54.000Z
CVE-2021-25101 Anti-Malware Security and Brute-Force Firewall < 4.20.94 - Admin+ Reflected Cross-Site Scripting
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Anti-Malware Security and Brute-Force Firewall
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:45:56.000Z
CVE-2021-25102 All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: All In One WP Security & Firewall
Credits: lang: en
value: JrXnm
Published: 2022-05-02T16:05:32.000Z
CVE-2021-25103 GTranslate < 2.9.7 - Reflected Cross-Site Scripting
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Translate WordPress with GTranslate
Credits: lang: en
value: JrXnm
Published: 2022-02-07T15:47:21.000Z
CVE-2021-25104 Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ocean Extra
Credits: lang: en
value: JrXnm
Published: 2022-06-20T10:25:41.000Z
CVE-2021-25105 Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting
The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ivory Search – WordPress Search Plugin
Credits: lang: en
value: Yoru Oni
Published: 2022-02-07T15:47:22.000Z
CVE-2021-25106 WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:23.000Z
CVE-2021-25107 Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Form Store to DB
Credits: lang: en
value: Yoru Oni
Published: 2022-02-14T09:20:51.000Z
CVE-2021-25108 IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: IP2Location Country Blocker
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:24.000Z
CVE-2021-25109 Futurio Extra < 1.6.3 - Authenticated SQL Injection
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Futurio Extra
Credits: lang: en
value: Jan w Oleju
Published: 2022-02-14T09:20:52.000Z
CVE-2021-25110 Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure
The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: Futurio Extra
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-14T09:20:53.000Z
CVE-2021-25111 English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect
The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: English WordPress Admin
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-25T15:50:47.000Z
CVE-2021-25112 WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WHMCS Bridge
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:36.000Z
CVE-2021-25113 Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS
The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Dropdown Menu Widget
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-04T15:35:39.000Z
CVE-2021-25114 Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Paid Memberships Pro
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:24.000Z
CVE-2021-25115 WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Photo Album Plus
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-14T09:20:55.000Z
CVE-2021-25116 Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Enqueue Anything
default_status: affected
Credits: lang: en
value: abhishek bhoir
lang: en
value: WPScan
Published: 2022-06-13T12:41:23.000Z
CVE-2021-25117 WP Postratings < 1.86.1 - Admin+ Stored Cross-Site Scripting
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP-PostRatings
default_status: unaffected
Credits: lang: en
value: Park Won Seok
lang: en
value: WPScan
Published: 2024-01-16T15:49:22.142Z
CVE-2021-25118 Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure
The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: Yoast SEO
Credits: lang: en
value: Fariq Fadillah Gusti Insani
Published: 2022-02-28T09:06:38.000Z
CVE-2021-25119 AGIL <= 1.0 - Admin+ Arbitrary File Upload
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: AGIL(Automatic Grid Image Listing)
Credits: lang: en
value: Chuang LI
Published: 2022-05-16T14:30:27.000Z
CVE-2021-25120 Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting
The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Social Feed Pro
vendor: Unknown
product: Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Credits: lang: en
value: Thura Moe Myint
Published: 2022-04-18T17:10:26.000Z
CVE-2021-25121 Rating by BestWebSoft < 1.6 - Rating Denial of Service
The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Unknown
product: Rating by BestWebSoft
Credits: lang: en
value: Drew Jones
Published: 2022-06-20T10:25:43.000Z
CVE-2021-25122 Apache Tomcat h2c request mix-up
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
Published: 2021-03-01T12:00:20.000Z
CVE-2021-25123 
The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice addlicense_func function.
Problem types: description: local spx_restservice addlicense_func function buffer overflow
Affected products: vendor: n/a
product: HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server
Published: 2021-01-29T12:30:08.000Z
CVE-2021-25124 
The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice deletevideo_func function path traversal vulnerability.
Problem types: description: local spx_restservice deletevideo_func function path traversal
Affected products: vendor: n/a
product: HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server
Published: 2021-01-29T18:06:42.000Z
CVE-2021-25125 
The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice delsolrecordedvideo_func function path traversal vulnerability.
Problem types: description: local spx_restservice delsolrecordedvideo_func function path traversal
Affected products: vendor: n/a
product: HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server
Published: 2021-01-29T18:10:21.000Z