Archive
29 January 2021
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
Unscored —
An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, …
-
Unscored —
Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnera…
-
Medium 6.5
MantisBT Missing Authorization access check in bug_actiongroup.php
An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue…
-
Medium —
MantisBT Incorrect Authorization in bug_actiongroup_page.php
An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bug_arr[]= in a crafted bug_actiongroup_page.php URL. (T…
-
Medium 4.3
MantisBT Insecure Storage in manage_proj_edit_page.php
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
-
Medium 4.9
Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated mali…
-
Medium 4.3
Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker …
-
Medium 4.6
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentia…
-
Medium 5.3
Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could …
-
Unscored —
The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could…
-
Unscored —
A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to g…
-
Unscored —
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore…
-
Unscored —
The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential…
-
Medium 6.5
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
High 8.8
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
Medium 6.5
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
High 8.0
A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing a…
-
Medium 5.4
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
Medium 6.5
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
Unscored —
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alph…
-
Unscored —CVE-2021-3298 Public exploit
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit…
-
Unscored —
DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavi…
-
Critical 9.8
Read of uninitialized memory in cdr
An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.
-
High 7.5
Soundness issue in raw-cpuid
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.
-
Unscored —
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the proce…
-
High 7.5
Uninitialized buffer use in marc
An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness.
-
Unscored —
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.
-
Unscored —
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.
-
Unscored —
A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.…