CVE-2021-43338

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43339. Reason: This candidate is a duplicate of CVE-2021-43339. Notes: All CVE users should reference CVE-2021-43339 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

UBUNTU-CVE-2018-6044

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-16064. Reason: This candidate is a reservation duplicate of CVE-2018-16064. Notes: All CVE users should reference CVE-2018-16064 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2018-6059

CVE-2018-6059 is a reservation/duplicate of CVE-2017-11225 and has been superseded; the description explicitly states this candidate should reference CVE-2017-11225 and that all references/descriptions for 2018-6059 were removed to prevent usage. The connected CVE-2017-11225 entry describes a use...

CVE-2018-6058

CVE-2018-6058 is rejected/duplicate; reference CVE-2017-11215 instead.

CVE-2018-6044

CVE-2018-6044 is a reservation duplicate of CVE-2018-16064. The concrete details come from CVE-2018-16064: Insufficient data validation in the Google Chrome Extensions API prior to 68.0.3440.75 allowed a user-assisted attacker to bypass navigation restrictions via a crafted Chrome Extension. Affe...

CVE-2021-41748

This CVE entry is rejected/not used; reference CVE-2021-41874 should be used instead.

Cross-Site Request Forgery (CSRF)

grumpydictator/firefly-iii is vulnerable to cross-site request forgery. An attacker can duplicate rules and modify the order of rule groups through the duplicate function in CreateController.php...

Duplicate Post < 1.2.0 - Authenticated SQL Injection

The plugin does not properly sanitise and escape the id parameter passed to the cdpactionhandling AJAX action, which could allow user having access to the plugin by default admins to perform SQL Injection attacks PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 229 Accept: /...

WordPress Duplicate Post plugin <= 1.1.9 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by AppCheck in WordPress Duplicate Post plugin versions = 1.1.9. Solution Update the WordPress Duplicate Post plugin to the latest available version at least 1.2.0...

in firefly-iii/firefly-iii

Description Firefly 3 allows users to register OAuth clients. However, Firefly allows duplicate client names to be registered into the application. Hence, attackers from a different account assuming registration is enabled can register a client with duplicate client name and trick the user into...

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

Description No CSRF in duplicate rule, and modifying the order of the rule group Proof of Concept Click Me! Click Me! Click Me! Impact This vulnerability is capable of tricking admin users to duplicate rule and modifying order of rule groups Permalinks selected with reference to this report:...

PT-2021-23142 · Snudown · Snudown

Name of the Vulnerable Software and Affected Versions: Snudown versions prior to 1.7.0 Description: Snudown, a reddit-specific fork of the Sundown Markdown parser, is vulnerable to denial of service attacks due to its reference table implementation. The hash table used for references written in...

CVE-2021-3542

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

UBUNTU-CVE-2021-3542

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2021-43408

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

CVE-2021-39330

CVE-2021-39330 is a duplicate of CVE-2021-24608 and is not a separate active entry. The correlated vulnerability is CVE-2021-24608: WordPress Formidable Form Builder plugin before 5.0.07 fails to sanitise/escape form labels, enabling stored XSS by high-privilege users. Affected product: Formidabl...

CVE-2021-39330

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-24608. Reason: This candidate is a duplicate of CVE-2021-24608. Notes: All CVE users should reference CVE-2021-24608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2021-24681

The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24681

The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24681

The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...