rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33393 
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-09T21:25:52.000Z
CVE-2021-33394 
Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T18:23:19.000Z
CVE-2021-33396 
Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2021-33403 
An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T21:24:53.000Z
CVE-2021-33408 
Local File Inclusion vulnerability in Ab Initio Control>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files. Fixed in v4.0.2.6 and v4.0.3.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-27T21:46:02.000Z
CVE-2021-33420 
A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2021-33425 
A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-25T13:41:35.000Z
CVE-2021-33430 
A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-17T18:36:51.000Z
CVE-2021-33436 
NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITY\SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T10:57:43.000Z
CVE-2021-33437 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:09:00.000Z
CVE-2021-33438 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:09:09.000Z
CVE-2021-33439 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:09:10.000Z
CVE-2021-33440 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:09:15.000Z
CVE-2021-33441 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:09:20.000Z
CVE-2021-33442 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:09:26.000Z
CVE-2021-33443 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:27:13.000Z
CVE-2021-33444 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:27:06.000Z
CVE-2021-33445 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:27:00.000Z
CVE-2021-33446 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:26:54.000Z
CVE-2021-33447 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:26:48.000Z
CVE-2021-33448 
An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:26:42.000Z
CVE-2021-33449 
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:26:37.000Z
CVE-2021-33450 
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:26:31.000Z
CVE-2021-33451 
An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:13.000Z
CVE-2021-33452 
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:18.000Z
CVE-2021-33453 
An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread() in stream.c:1538.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:24.000Z
CVE-2021-33454 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:29.000Z
CVE-2021-33455 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:34.000Z
CVE-2021-33456 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:40.000Z
CVE-2021-33457 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:45.000Z
CVE-2021-33458 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:51.000Z
CVE-2021-33459 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:36:56.000Z
CVE-2021-33460 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:37:02.000Z
CVE-2021-33461 
An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:53:03.000Z
CVE-2021-33462 
An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:54.000Z
CVE-2021-33463 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:46.000Z
CVE-2021-33464 
An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:40.000Z
CVE-2021-33465 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:34.000Z
CVE-2021-33466 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:26.000Z
CVE-2021-33467 
An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:21.000Z
CVE-2021-33468 
An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:52:14.000Z
CVE-2021-33469 
COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T16:36:56.000Z
CVE-2021-33470 
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T16:39:33.000Z
CVE-2021-33473 
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T19:55:57.000Z
CVE-2021-33477 
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T19:16:01.000Z
CVE-2021-33478 
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-22T16:53:32.000Z
CVE-2021-33479 
A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: gocr
Published: 2021-11-17T00:00:00.000Z
CVE-2021-33480 
An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: gocr
Published: 2021-11-17T00:00:00.000Z
CVE-2021-33481 
A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: gocr
Published: 2021-11-17T00:00:00.000Z
CVE-2021-33483 
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T04:56:27.000Z
CVE-2021-33484 
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-07T04:59:00.000Z
CVE-2021-33485 
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T15:44:56.000Z
CVE-2021-33486 
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-03T15:58:06.000Z
CVE-2021-33488 
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T07:32:10.000Z
CVE-2021-33489 
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T07:36:44.000Z
CVE-2021-33490 
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T07:39:39.000Z
CVE-2021-33491 
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T08:12:58.000Z
CVE-2021-33492 
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T08:16:25.000Z
CVE-2021-33493 
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T08:24:42.000Z
CVE-2021-33494 
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T08:27:26.000Z
CVE-2021-33495 
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-22T08:30:10.000Z
CVE-2021-33496 
Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T04:02:58.000Z
CVE-2021-33497 
Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T04:06:36.000Z
CVE-2021-33498 
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T16:21:45.000Z
CVE-2021-33499 
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T16:23:09.000Z
CVE-2021-33500 
PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2021-05-21T19:42:26.000Z
CVE-2021-33501 
Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-19T11:37:24.000Z
CVE-2021-33502 
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T15:42:34.000Z
CVE-2021-33503 
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-29T10:55:35.000Z
CVE-2021-33504 
Couchbase Server before 7.1.0 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T20:29:03.000Z
CVE-2021-33505 
A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls being executed. Issue is fixed in Falco versions >= 0.29.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-15T10:26:06.000Z
CVE-2021-33506 
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conference moderation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-26T14:46:30.000Z
CVE-2021-33507 
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:33:31.000Z
CVE-2021-33508 
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:33:12.000Z
CVE-2021-33509 
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:33:00.000Z
CVE-2021-33510 
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:32:39.000Z
CVE-2021-33511 
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:32:24.000Z
CVE-2021-33512 
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:32:10.000Z
CVE-2021-33513 
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-21T21:31:55.000Z