Security Vulnerabilities - CVEs Published In March 2021
A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1
CVSS Score
6.1
EPSS Score
0.003
Published
2021-03-15
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
CVSS Score
6.5
EPSS Score
0.001
Published
2021-03-15
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
CVSS Score
8.8
EPSS Score
0.057
Published
2021-03-15
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).
CVSS Score
8.8
EPSS Score
0.002
Published
2021-03-15
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).
CVSS Score
7.2
EPSS Score
0.003
Published
2021-03-15
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).
CVSS Score
7.2
EPSS Score
0.003
Published
2021-03-15
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-03-15
myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: CSRF Token. The attack vector is: CSRF token injection to XSS.
CVSS Score
9.6
EPSS Score
0.003
Published
2021-03-15
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
CVSS Score
8.1
EPSS Score
0.032
Published
2021-03-15
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
CVSS Score
5.5
EPSS Score
0.001
Published
2021-03-15