Archive
22 April 2021
Vulnerabilities first published on this day (UTC), newest first.
297 results · Feed
-
Low 2.5
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported versio…
-
High 8.1
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported ve…
-
Medium 6.7
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported ve…
-
High 8.2
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions th…
-
Low 1.8
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Installation). The supporte…
-
Medium 4.3
Vulnerability in the Oracle Internet Expenses product of Oracle E-Business Suite (component: Mobile Expenses). Supporte…
-
High 7.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 6.1
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servi…
-
Medium 6.1
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). The supported ver…
-
Medium 6.5
Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Cont…
-
High 7.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…
-
Critical 9.8CVE-2021-2135 Scanner template
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Suppo…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are aff…
-
Low 2.0
Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre L…
-
Medium 6.1
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). T…
-
High 7.3
Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Cont…
-
Unscored —
Trend Micro Antivirus for Mac 2020 v10.5 and 2021 v11 (Consumer) is vulnerable to an improper access control privilege …
-
Unscored —
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to…
-
Unscored —
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to…
-
Unscored —
Tutor LMS < 1.8.8 - Authenticated Local File Inclusion
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any l…
-
Unscored —CVE-2021-24239 Scanner template
Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-…
-
Unscored —
Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
-
Unscored —
Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
-
Unscored —
Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property…
-
Unscored —CVE-2021-24235 Scanner template
Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS
The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
-
Unscored —
Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue
-
Unscored —
Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. …
-
Unscored —
Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
-
Unscored —CVE-2021-24237 Scanner template
Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cr…
-
Unscored —
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30).…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions <…
-
Unscored —
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network …
-
Unscored —
A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nuc…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions <…
-
Unscored —
A vulnerability has been identified in Tecnomatix RobotExpert (All versions < V16.1). Affected applications lack proper…
-
Medium 5.3
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…
-
Medium 6.5
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…
-
Unscored —
A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions …
-
Unscored —
A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions …