Archive
3 June 2021
Vulnerabilities first published on this day (UTC), newest first.
53 results · Feed
-
Unscored —
Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because r…
-
Unscored —
Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because t…
-
Unscored —
The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records …
-
Unscored —
OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability.
-
Unscored —
OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability.
-
Unscored —
AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker…
-
Unscored —
AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitra…
-
Unscored —
AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrar…
-
Unscored —
AppCMS 2.0.101 in /admin/download_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitiv…
-
Medium 6.5
TechDocs mkdocs.yml path traversal
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environm…
-
Medium 6.5
Asset DoS vulnerability
wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial of service between users. If a user has an invalid assetID for their profile picture and it contains…
-
High 8.8
Verified groups not reliable
wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incorrectly set to "unverified. This occurs when: - Self user is added to a new conversation - Self user …
-
Unscored —
An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allow…
-
Unscored —
A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malici…
-
Unscored —
An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/memb…
-
Unscored —
An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via …
-
Unscored —
Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privileg…
-
Critical 9.8
Prototype pollution in nestie
Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Unscored —
Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated…
-
Unscored —
There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability m…
-
Unscored —
There is a Memory Buffer Improper Operation Limit vulnerability in Huawei Smartphone. Successful exploitation of this v…
-
Unscored —
There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability ma…
-
Unscored —
There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vuln…
-
Medium 6.8
TechDocs object element script injection
Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding…
-
Medium 6.8
TechDocs content sanitization bypass
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation c…
-
Unscored —
There is an Improper Control of Generation of Code vulnerability in Huawei Smartphone. Successful exploitation of this …
-
Unscored —
There is a Credentials Management Errors vulnerability in Huawei Smartphone. Successful exploitation of this vulnerabil…
-
Unscored —
There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability ma…
-
Unscored —
There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Successful exploitation of …
-
Unscored —
There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Attackers with physical acc…
-
Unscored —
There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability ma…
-
Unscored —
There is a Security Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impa…
-
Unscored —
There is a Business Logic Errors vulnerability in Huawei Smartphone. The malicious apps installed on the device can kee…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
-
Medium 5.3
IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain s…
-
Unscored —
Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.
-
Unscored —
WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because t…
-
Medium 5.9
When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the…
-
Unscored —
The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted dat…
-
Unscored —
Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window …