Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-24489 (GCVE-0-2021-24489)
Vulnerability from cvelistv5 – Published: 2021-10-25 13:20 – Updated: 2024-08-03 19:35
VLAI?
EPSS
Title
Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting
Summary
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Request a Quote |
Affected:
0 , < 2.3.9
(custom)
|
Credits
WPScan
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:20.198Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Request a Quote",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.3.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Cross-Site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-05T07:51:30.396Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Request a Quote \u003c 2.3.9 - Admin+ Stored Cross-Site Scripting",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24489",
"datePublished": "2021-10-25T13:20:38.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:35:20.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTFR-2021-AVI-446
Vulnerability from certfr_avis - Published: 2021-06-09 - Updated: 2021-06-09
De multiples vulnérabilités ont été découvertes dans les produits Intel. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Intel | N/A | Intel RealSense ID F450 et F455 sans le dernier correctif de sécurité | ||
| Intel | N/A | Intel Optane DC Persistent Memory for Windows versions antérieures à 2.00.00.3842 et 1.00.00.3515 | ||
| Intel | N/A | Intel VTune Profiler versions antérieures à 2021.1.1 | ||
| Intel | N/A | Intel SGX (se référer au bulletin de sécurité intel-sa-00477 de l'éditeur, cf. section Documentation) | ||
| Intel | N/A | les produits Intel Wireless Bluetooth et Killer Bluetooth (se référer au bulletin de sécurité intel-sa-00520 de l'éditeur, cf. section Documentation) | ||
| Intel | N/A | Intel SSD Data Center Tool versions téléchargées avant le 31 décembre 2020, Intel recommande de remplacer cet outil par Intel Memory and Storage Tool (MAS) for SSD | ||
| Intel | N/A | Intel NUC M15 Laptop Kit Driver Pack versions antérieures à 1.1 | ||
| Intel | N/A | Intel Rapid Storage Technology versions antérieures à 17.9.1.1009.5, 18.0.3.1148.4 et 18.1.0.1028.2 | ||
| Intel | N/A | les processeurs Intel (se référer aux bulletins de sécurité intel-sa-00442, intel-sa-00463, intel-sa-00521, intel-sa-00459, intel-sa-00464, intel-sa-00465, intel-sa-00500 et intel-sa-00516 de l'éditeur, cf. section Documentation) | ||
| Intel | N/A | les versions du noyau Linux antérieures à 5.13 qui supportent BlueZ | ||
| Intel | N/A | Intel Processor Diagnostic Tool versions antérieures à 4.1.5.37 | ||
| Intel | N/A | les pilotes WiFi Intel ProSet/Wireless versions antérieures à 22.0 | ||
| Intel | N/A | Intel Computing Improvement Program versions antérieures à 2.4.6522 | ||
| Intel | N/A | Intel DSA versions antérieures à 20.11.50.9 | ||
| Intel | N/A | les pilotes Intel NUC 9 Extreme Laptop Kit LAN versions antérieures à 10.45 | ||
| Intel | N/A | Intel Server Board M10JNP2SB sans la mise à jour comprenant EFI BIOS 7215 et BMC 8100.01.08 | ||
| Intel | N/A | Intel Unite Client pour Windows versions antérieures à 4.2.25031 | ||
| Intel | N/A | Intel Thunderbolt (se référer au bulletin de sécurité intel-sa-00401 de l'éditeur, cf. section Documentation) | ||
| Intel | N/A | Intel Brand Verification Tool versions antérieures à 11.0.0.1225 | ||
| Intel | N/A | Intel Server System gammes R1000WF et R2000WF, Server Board gamme S2600WF, Server Board gamme S2600ST, Compute Module gamme HNS2600BP et Server Board gamme S2600BP versions antérieures à 2.48.ce3e3bd2 | ||
| Intel | N/A | Intel NUC (se référer au bulletin de sécurité intel-sa-00511 de l'éditeur, cf. section Documentation) | ||
| Intel | N/A | les pilotes FPGA OPAE pour Linux (se référer au bulletin de sécurité intel-sa-00440 de l'éditeur, cf. section Documentation) | ||
| Intel | N/A | Intel IPP versions antérieures à 2020 update 1 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Intel RealSense ID F450 et F455 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Optane DC Persistent Memory for Windows versions ant\u00e9rieures \u00e0 2.00.00.3842 et 1.00.00.3515",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel VTune Profiler versions ant\u00e9rieures \u00e0 2021.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SGX (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 intel-sa-00477 de l\u0027\u00e9diteur, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "les produits Intel Wireless Bluetooth et Killer Bluetooth (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 intel-sa-00520 de l\u0027\u00e9diteur, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SSD Data Center Tool versions t\u00e9l\u00e9charg\u00e9es avant le 31 d\u00e9cembre 2020, Intel recommande de remplacer cet outil par Intel Memory and Storage Tool (MAS) for SSD",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC M15 Laptop Kit Driver Pack versions ant\u00e9rieures \u00e0 1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Rapid Storage Technology versions ant\u00e9rieures \u00e0 17.9.1.1009.5, 18.0.3.1148.4 et 18.1.0.1028.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "les processeurs Intel (se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 intel-sa-00442, intel-sa-00463, intel-sa-00521, intel-sa-00459, intel-sa-00464, intel-sa-00465, intel-sa-00500 et intel-sa-00516 de l\u0027\u00e9diteur, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "les versions du noyau Linux ant\u00e9rieures \u00e0 5.13 qui supportent BlueZ",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Processor Diagnostic Tool versions ant\u00e9rieures \u00e0 4.1.5.37",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "les pilotes WiFi Intel ProSet/Wireless versions ant\u00e9rieures \u00e0 22.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Computing Improvement Program versions ant\u00e9rieures \u00e0 2.4.6522",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel DSA versions ant\u00e9rieures \u00e0 20.11.50.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "les pilotes Intel NUC 9 Extreme Laptop Kit LAN versions ant\u00e9rieures \u00e0 10.45",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server Board M10JNP2SB sans la mise \u00e0 jour comprenant EFI BIOS 7215 et BMC 8100.01.08",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Unite Client pour Windows versions ant\u00e9rieures \u00e0 4.2.25031",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Thunderbolt (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 intel-sa-00401 de l\u0027\u00e9diteur, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Brand Verification Tool versions ant\u00e9rieures \u00e0 11.0.0.1225",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server System gammes R1000WF et R2000WF, Server Board gamme S2600WF, Server Board gamme S2600ST, Compute Module gamme HNS2600BP et Server Board gamme S2600BP versions ant\u00e9rieures \u00e0 2.48.ce3e3bd2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 intel-sa-00511 de l\u0027\u00e9diteur, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "les pilotes FPGA OPAE pour Linux (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 intel-sa-00440 de l\u0027\u00e9diteur, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel IPP versions ant\u00e9rieures \u00e0 2020 update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-0090",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0090"
},
{
"name": "CVE-2020-24516",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24516"
},
{
"name": "CVE-2020-12288",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12288"
},
{
"name": "CVE-2020-8700",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8700"
},
{
"name": "CVE-2020-24474",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24474"
},
{
"name": "CVE-2021-0134",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0134"
},
{
"name": "CVE-2021-0094",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0094"
},
{
"name": "CVE-2021-0086",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0086"
},
{
"name": "CVE-2020-12289",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12289"
},
{
"name": "CVE-2020-12293",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12293"
},
{
"name": "CVE-2021-0089",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0089"
},
{
"name": "CVE-2021-0051",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0051"
},
{
"name": "CVE-2020-12292",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12292"
},
{
"name": "CVE-2021-0098",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0098"
},
{
"name": "CVE-2021-0095",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0095"
},
{
"name": "CVE-2021-0052",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0052"
},
{
"name": "CVE-2020-12291",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12291"
},
{
"name": "CVE-2020-12360",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12360"
},
{
"name": "CVE-2021-0073",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0073"
},
{
"name": "CVE-2021-0056",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0056"
},
{
"name": "CVE-2021-0132",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0132"
},
{
"name": "CVE-2021-0001",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0001"
},
{
"name": "CVE-2020-8703",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8703"
},
{
"name": "CVE-2021-0100",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0100"
},
{
"name": "CVE-2020-12357",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12357"
},
{
"name": "CVE-2021-0129",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0129"
},
{
"name": "CVE-2020-24475",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24475"
},
{
"name": "CVE-2020-8702",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8702"
},
{
"name": "CVE-2021-0058",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0058"
},
{
"name": "CVE-2021-0097",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0097"
},
{
"name": "CVE-2020-24513",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24513"
},
{
"name": "CVE-2020-24514",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24514"
},
{
"name": "CVE-2021-0104",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0104"
},
{
"name": "CVE-2021-0108",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0108"
},
{
"name": "CVE-2020-24473",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24473"
},
{
"name": "CVE-2020-24507",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24507"
},
{
"name": "CVE-2021-0070",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0070"
},
{
"name": "CVE-2020-12358",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12358"
},
{
"name": "CVE-2020-24509",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24509"
},
{
"name": "CVE-2020-26558",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
},
{
"name": "CVE-2021-0106",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0106"
},
{
"name": "CVE-2020-12290",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12290"
},
{
"name": "CVE-2021-0057",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0057"
},
{
"name": "CVE-2020-24485",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24485"
},
{
"name": "CVE-2021-0113",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0113"
},
{
"name": "CVE-2020-8670",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8670"
},
{
"name": "CVE-2020-24515",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24515"
},
{
"name": "CVE-2020-8704",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8704"
},
{
"name": "CVE-2020-12296",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12296"
},
{
"name": "CVE-2021-0102",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0102"
},
{
"name": "CVE-2020-12294",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12294"
},
{
"name": "CVE-2020-12295",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12295"
},
{
"name": "CVE-2021-0101",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0101"
},
{
"name": "CVE-2020-12359",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12359"
},
{
"name": "CVE-2021-0077",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0077"
},
{
"name": "CVE-2021-0105",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0105"
},
{
"name": "CVE-2020-24486",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24486"
},
{
"name": "CVE-2021-0131",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0131"
},
{
"name": "CVE-2021-0067",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0067"
},
{
"name": "CVE-2020-24506",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24506"
},
{
"name": "CVE-2020-24512",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24512"
},
{
"name": "CVE-2021-0074",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0074"
},
{
"name": "CVE-2020-26555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
},
{
"name": "CVE-2021-24489",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24489"
},
{
"name": "CVE-2020-24511",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24511"
},
{
"name": "CVE-2021-0055",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0055"
},
{
"name": "CVE-2021-0133",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0133"
},
{
"name": "CVE-2021-0112",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0112"
},
{
"name": "CVE-2021-0054",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0054"
}
],
"initial_release_date": "2021-06-09T00:00:00",
"last_revision_date": "2021-06-09T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-446",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-06-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Intel.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une \u00e9l\u00e9vation\nde privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Intel",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00516 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00516.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00463 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00510 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00510.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00506 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00505 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00505.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00545 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00545.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00520 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00442 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00477 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00477.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00476 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00476.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00472 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00472.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00530 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00458 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00458.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00521 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00521.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00401 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00401.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00440 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00440.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00507 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00507.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00459 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00541 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00541.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00474 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00474.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00500 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00500.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00518 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00518.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00546 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00546.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00517 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00511 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00511.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00537 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00537.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00465 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00460 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00460.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00464 du 08 juin 2021",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html"
}
]
}
CERTFR-2021-AVI-456
Vulnerability from certfr_avis - Published: 2021-06-10 - Updated: 2021-06-10
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Ubuntu 16.04 ESM",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 20.10",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 18.04 LTS",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 21.04",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 20.04 LTS",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
},
{
"description": "Ubuntu 14.04 ESM",
"product": {
"name": "Ubuntu",
"vendor": {
"name": "Ubuntu",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-24513",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24513"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2020-24512",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24512"
},
{
"name": "CVE-2021-24489",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24489"
},
{
"name": "CVE-2020-24511",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24511"
}
],
"initial_release_date": "2021-06-10T00:00:00",
"last_revision_date": "2021-06-10T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-456",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-06-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux\nd\u0027Ubuntu. Elles permettent \u00e0 un attaquant de provoquer un contournement\nde la politique de s\u00e9curit\u00e9, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux d\u0027Ubuntu",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-4985-1 du 09 juin 2021",
"url": "https://ubuntu.com/security/notices/USN-4985-1"
}
]
}
GSD-2021-24489
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-24489",
"description": "The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.",
"id": "GSD-2021-24489"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-24489"
],
"details": "The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.",
"id": "GSD-2021-24489",
"modified": "2023-12-13T01:23:37.682326Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24489",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Request a Quote",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "0",
"version_value": "2.3.9"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credits": [
{
"lang": "en",
"value": "WPScan"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed."
}
]
},
"generator": {
"engine": "WPScan CVE Generator"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-Site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:emarketdesign:request_a_quote:*:*:*:*:*:wordpress:*:*",
"cpe_name": [],
"versionEndExcluding": "2.3.5",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24489"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7
}
},
"lastModifiedDate": "2023-04-05T08:15Z",
"publishedDate": "2021-10-25T14:15Z"
}
}
}
GHSA-GQJM-7FJ6-9XVX
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2023-04-05 09:30
VLAI?
Details
The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Severity ?
4.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-24489"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-25T14:15:00Z",
"severity": "MODERATE"
},
"details": "The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.",
"id": "GHSA-gqjm-7fj6-9xvx",
"modified": "2023-04-05T09:30:18Z",
"published": "2022-05-24T19:18:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24489"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2021-24489
Vulnerability from fkie_nvd - Published: 2021-10-25 14:15 - Updated: 2024-11-21 05:53
Severity ?
Summary
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
References
| URL | Tags | ||
|---|---|---|---|
| contact@wpscan.com | https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| emarketdesign | request_a_quote | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:emarketdesign:request_a_quote:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "DAAACD81-A772-455F-8E5B-8CDC8C9B1071",
"versionEndExcluding": "2.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed."
},
{
"lang": "es",
"value": "El plugin Request a Quote de WordPress versiones anteriores a 2.3.5, no sanea, comprueba o escapa de algunas de sus configuraciones en el panel de administraci\u00f3n, conllevando a problemas de tipo Cross-Site Scripting Almacenado y autenticado, incluso cuando la capacidad unfiltered_html no est\u00e1 permitida"
}
],
"id": "CVE-2021-24489",
"lastModified": "2024-11-21T05:53:10.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-10-25T14:15:10.143",
"references": [
{
"source": "contact@wpscan.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c"
}
],
"sourceIdentifier": "contact@wpscan.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…