Archive
28 May 2021
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
High 8.0
Post-authentication Remote Code Execution (RCE) in emissary:emissary
Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f6…
-
High 8.8
Users registered with email verification can self re-activate their disabled accounts
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by usi…
-
High 8.8
Script injection without script or programming rights through Gadget titles
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget title…
-
High 8.1CVE-2021-29492 EPSS 63%
Bypass of path matching rules using escaped slash characters
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypas…
-
High 7.5
XStream is vulnerable to a Remote Command Execution attack
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No u…
-
Medium 5.7
dlt-daemon could crash if there is special character in dlt.conf
GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are u…
-
Critical 9.8
Static imports inside dynamically imported modules do not adhere to permission checks
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission che…
-
Unscored —
Stack overflow vulnerability in parse_equality Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service…
-
Unscored —
Stack overflow vulnerability in parse_shifts Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (…
-
Unscored —
Stack overflow vulnerability in parse_comparison Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Servi…
-
Unscored —
Stack overflow vulnerability in parse_statement_list Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of S…
-
Unscored —
Stack overflow vulnerability in parse_plus_minus Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Servi…
-
Unscored —
Stack overflow vulnerability in parse_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (D…
-
Unscored —
Stack overflow vulnerability in parse_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Servic…
-
Unscored —
Stack overflow vulnerability in parse_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (D…
-
Unscored —
Stack overflow vulnerability in parse_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (D…
-
Unscored —
Stack overflow vulnerability in parse_mul_div_rem Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Serv…
-
Unscored —
Stack overflow vulnerability in parse_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (D…
-
Unscored —
A NULL-pointer deference issue was discovered in GNU_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial…
-
High 8.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1CDN
1CDN is open-source file sharing software. In 1CDN before commit f88a2730fa50fc2c2aeab09011f6f142fd90ec25, there is a basic cross-site scripting vulnerability that allows an attacker to inject /<script>//code</script> and execute JavaScript code on the client…
-
Medium 6.3
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the conta…
-
Unscored —
A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute …
-
Unscored —
A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an a…
-
Unscored —
Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50),…
-
Medium —
Cross-site scripting vulnerability in TinyMCE
### Impact A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser for `form` elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the ed…
-
High —
constructEvent does not verify header
### Impact Anyone verifying a Stripe webhook request via this library's `constructEvent` function. ### Patches Upgrade to 1.1.4. ### Workarounds Use `await verifyHeader(...)` directly instead of `constructEvent`. ### References https://github.com/worker-tools…
-
High 7.1
Openstack Neutron has Insufficient Verification of IPv6 addresses
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resul…
-
Medium 5.3
Escalation of permissions in roomer
Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the ``manage channel`` permissions in a private VC they hav…
-
Critical 10.0
Authentication bypassed with malformed request URI
Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It …
-
Unscored —
An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to …
-
High 7.0
Missing input validation in dynamic discovery example scripts.
radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` and `radsec-dynsrv.sh` scripts can lead to configuration injection via crafted radsec peer discovery …
-
Critical 9.8
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open C…
-
Low —
Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build
### Impact If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project. ### Patches The problem has been patched in v1.0…
-
Unscored —
In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEAS…
-
Unscored —
In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEAS…
-
Medium 4.0
Permissions bypass in SmallRye
A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vu…
-
Unscored —
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default pa…
-
Unscored —
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this fil…
-
Unscored —
Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by …
-
Unscored —
Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited p…