Security Vulnerabilities - CVEs Published In 2021
OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.
CVSS Score
7.2
EPSS Score
0.018
Published
2021-08-27
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
CVSS Score
5.3
EPSS Score
0.013
Published
2021-08-27
An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.
CVSS Score
9.8
EPSS Score
0.019
Published
2021-08-27
A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.
CVSS Score
8.8
EPSS Score
0.011
Published
2021-08-27
The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.
CVSS Score
9.8
EPSS Score
0.01
Published
2021-08-27
Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'.
CVSS Score
6.1
EPSS Score
0.012
Published
2021-08-27
Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'.
CVSS Score
6.1
EPSS Score
0.012
Published
2021-08-27
Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiki/blob/master/simiki/generators.py'.
CVSS Score
6.1
EPSS Score
0.011
Published
2021-08-27
Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'.
CVSS Score
9.8
EPSS Score
0.043
Published
2021-08-27
Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.
CVSS Score
6.1
EPSS Score
0.011
Published
2021-08-27