CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 1CVE-2021-21703 – PHP-FPM memory access in root process leading to privilege escalation
https://notcve.org/view.php?id=CVE-2021-21703
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user. En PHP versiones 7.3.x hasta 7.3.31 incluyéndola, versiones 7.4.x y por debajo de 7.4.25 y versiones 8.0.x por debajo de 8.0. 12, cuando es ejecutado PHP FPM SAPI con el proceso demonio FPM principal ejecutado como root y los procesos worker hijos ejecutados como usuarios menos privilegiados, es posible que los procesos hijos accedan a la memoria compartida con el proceso principal y escriban en ella, modificándola de forma que causaría que el proceso root realizara lecturas y escrituras de memoria no válidas, que puede ser usado para escalar los privilegios del usuario local sin privilegios al usuario root php-fpm has a vulnerability which may lead to local privilege escalation. This vulnerability is hard to exploit as the attack needs to escape the FPM sandbox mechanism. When a complete attack is achieved it may lead to risk for confidentiality, data integrity, and system availability. • http://www.openwall.com/lists/oss-security/2021/10/26/7 https://bugs.php.net/bug.php?id=81026 https://lists.debian.org/debian-lts-announce/2021/10/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PZVLICZUJMXOGWOUWSBAEGIVTF6Y6V3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO5RA6YOBGGGKLIA6F6BQRZDDECF5L3R https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBM3KKB3RY2YPOKNMC4HIH7I • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-284: Improper Access Control CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-21706 – ZipArchive::extractTo may extract outside of destination dir
https://notcve.org/view.php?id=CVE-2021-21706
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions. En PHP versiones de 7.3.x por debajo de 7.3.31, versiones 7.4.x por debajo de 7.4.24 y 8.0.x por debajo de 8.0.11, en el entorno de Microsoft Windows, la función ZipArchive::extractTo puede ser engañada para escribir un archivo fuera del directorio de destino cuando es extraído un archivo ZIP, causando así potencialmente una creación o sobreescritura de archivos, sujeto a los permisos del Sistema Operativo • https://bugs.php.net/bug.php?id=81420 https://security.netapp.com/advisory/ntap-20211029-0007 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-24: Path Traversal: '../filedir' •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2021-25791 – Online Doctor Appointment System 1.0 - 'Multiple' Stored XSS
https://notcve.org/view.php?id=CVE-2021-25791
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields. Múltiples vulnerabilidades de cross site scripting (XSS) almacenadas en el módulo "Update Profile" de Online Doctor Appointment System versión 1.0, permiten a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de cargas útiles diseñadas en los campos de texto First Name, Last Name y Address • https://www.exploit-db.com/exploits/49396 https://github.com/MrCraniums/CVE-2021-25791-Multiple-Stored-XSS https://www.sourcecodester.com https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2021-25790
https://notcve.org/view.php?id=CVE-2021-25790
Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number. Múltiples vulnerabilidades de tipo cross site scripting (XSS) almacenadas en el módulo "Register" de House Rental and Property Listing versión 1.0, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de cargas útiles diseñadas en todos los campos de texto excepto en Phone Number y Alternate Phone Number • https://github.com/MrCraniums/CVE-2021-25790-Multiple-Stored-XSS https://www.exploit-db.com/exploits/49352 https://www.sourcecodester.com https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-23702
https://notcve.org/view.php?id=CVE-2020-23702
Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en PHP-Fusion versión 9.03.60, por medio de "New Shout" en el archivo /infusions/shoutbox_panel/shoutbox_admin.php • https://github.com/phpfusion/PHPFusion/issues/2328 https://user-images.githubusercontent.com/62001260/82175522-47169980-98fe-11ea-9a8e-93622aab7cf4.PNG • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •