Archive
19 January 2021
Vulnerabilities first published on this day (UTC), newest first.
48 results · Feed
-
Unscored —CVE-2020-28707 Public exploit
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_…
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump an…
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insuli…
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insuli…
-
Unscored —
Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. …
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump an…
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the co…
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu …
-
High 7.2
Query Binding Exploitation in Laravel
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field th…
-
Unscored —
Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authentic…
-
Unscored —
In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials t…
-
High 8.1
Deserialization of untrusted data in jackson-databind
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
-
Unscored —
SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its Any…
-
Unscored —
SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-…
-
Unscored —
SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyD…
-
Unscored —
MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
-
Unscored —
XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Qualit…
-
Unscored —
Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmv…
-
Unscored —
The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the …
-
Unscored —
MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
-
Unscored —
MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could…
-
Medium 5.9
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server …
-
Medium 5.3
IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS pol…
-
Medium 4.0
IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X…
-
Unscored —
Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and …
-
Medium 5.9
Cross-site Request Forgery (CSRF)
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter
-
Medium 5.9
Denial of Service (DoS)
The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
-
High 7.3
Prototype Pollution
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leadin…
-
Medium 5.3
Insecure Defaults
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
-
High 8.0
D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer suppo…
-
Unscored —
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending…
-
Unscored —
A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
-
Critical 9.0
Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventu…
-
Critical 9.0
Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow…
-
Unscored —
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 20…
-
Unscored —CVE-2020-23522 Public exploit
Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.
-
High 7.3
Prototype Pollution
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the ap…
-
High 7.5
-
High 7.5
-
High 8.8
HGiga OAKloud Portal - SQL injection -2
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.