Archive
15 March 2021
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Unscored —
ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can lev…
-
Medium 4.3
Missing permission check in Moodle
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.3
Moodle Bypass email verification secret when confirming account registration
When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.3
Moodle allowed some users without permission to view other users' full names
It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.4
Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle
Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.4
Moodle contains Stored XSS via ID number user profile field
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Unscored —
Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are …
-
Unscored —
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilat…
-
Unscored —
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allow…
-
Unscored —
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attacker…
-
Unscored —
If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel witho…
-
Unscored —
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a c…
-
Unscored —
A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an…
-
Medium 6.7
Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and ...
Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect …
-
High 8.8
Grav CMS Cross-Site Request Forgery (CSRF)
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
-
High 8.1
Grav CMS Arbitrary File Deletion
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attack…
-
Medium 5.5
Grav CMS Local File Injection
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker…
-
Unscored —
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the Menu…
-
Medium 6.3
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet …
-
Unscored —
An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update 9. It allows CSRF. An attacker may be able to tric…
-
Unscored —
A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of servic…
-
Unscored —
myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The compon…
-
Unscored —
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
-
Unscored —
SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3).
-
Unscored —
SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3).
-
Unscored —CVE-2021-27946 Public exploit
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).
-
Unscored —
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
-
Unscored —
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions <…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions <…
-
Unscored —
A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the syst…
-
Unscored —
A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE S…
-
Medium 6.5
A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions…
-
Unscored —
A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the syst…
-
Unscored —
A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the syst…
-
Unscored —
A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions < V3.2.1). The Forgot Passw…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions <…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions <…
-
Unscored —
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the af…
-
Unscored —
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can acce…
-
Unscored —
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow un…