Archive
24 May 2021
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
Medium 5.3
IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical erro…
-
High 7.2
IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by s…
-
Medium 5.9
IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for …
-
Medium 5.1
IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force I…
-
Medium 6.8
IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h…
-
Medium 6.1
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
High 7.6
IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statement…
-
High 8.4
IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By …
-
Medium 6.4
Improper Input Validation in Bitdefender Endpoint Security Tools for Linux
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue…
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows…
-
Unscored —
Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwo…
-
Unscored —
Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalat…
-
Unscored —
Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification …
-
Unscored —
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.
-
Unscored —
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Exe…
-
Unscored —
Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Esca…
-
Unscored —CVE-2020-28905 EPSS 26%
Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code vi…
-
Unscored —
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via …
-
Unscored —CVE-2020-28903 EPSS 13%
Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server …
-
Unscored —
Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
-
Unscored —CVE-2020-28901 EPSS 12%
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vect…
-
Unscored —
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allow…
-
Unscored —
Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.
-
Unscored —
Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php.
-
Unscored —
Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existin…
-
Unscored —
Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters.
-
Unscored —
A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts wit…
-
Unscored —
VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds rea…
-
Unscored —
VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds rea…
-
Unscored —
VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds rea…
-
Critical 9.1
WAGO: PFC200 Access to files outside the home directory
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
-
Medium 5.3
WAGO: PFC200 Denial of Service due to the number of connections to the runtime
On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
-
Unscored —
All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore pl…
-
Unscored —
Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated refle…
-
Unscored —
Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
-
Unscored —CVE-2021-24308 Public exploit
LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a …
-
Unscored —
Goto < 2.1 - Reflected Cross-Site Scripting (XSS)
The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
-
Unscored —
Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be expl…
-
Unscored —
WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
-
Unscored —
Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS)
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.