Archive
7 May 2021
Vulnerabilities first published on this day (UTC), newest first.
18 results · Clear filters · Feed
-
Medium 6.1
Craft CMS Cross-site Scripting Vulnerability
Craft CMS before 3.6.13 has an XSS vulnerability.
-
Medium 5.4
IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive…
-
Medium 5.9
Nim stdlib httpClient does not validate peer certificates by default
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyM…
-
Medium 4.3
Creation of files outside the Download Folder through malicious PAR2 files
SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as …
-
Medium 5.3
Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version…
-
Medium 6.5
Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion
Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.
-
Medium 4.6
Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS
Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additional…
-
Medium 4.6
Jun-He Technology Ltd. ERP POS - Stored XSS-2
Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s …
-
Medium 4.6
Jun-He Technology Ltd. ERP POS - Stored XSS-1
Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate…
-
Medium 6.2CVE-2021-1906 Exploited
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Au…
KEV Nov 3, 2021 -
Medium 6.8
Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon I…
-
Medium 6.8
Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snap…
-
Medium 5.9
Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, …
-
Medium 5.1
Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer …
-
Medium 6.2
Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is vali…
-
Medium 4.3
Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify …
-
Medium 5.4
Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javas…
-
Medium 6.1
Cross-site scripting in LocalStack
A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.