Archive
7 June 2021
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 b…
-
Unscored —
EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before versio…
-
Unscored —CVE-2021-26078 Public exploit
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 befor…
-
Critical 10.0CVE-2021-32671 EPSS 40%
XSS vulnerability with translator
Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or docume…
-
High 7.2
Reflected cross-site scripting issue in Datasette
Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#ref…
-
Unscored —CVE-2021-3277 EPSS 59%
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the ren…
-
Critical 9.1
Improper Certificate Validation in WP-CLI framework
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-C…
-
High 7.3
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
-
High 7.8
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as we…
-
Unscored —
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files i…
-
Unscored —
A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container c…
-
Unscored —
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attack…
-
Unscored —
An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-roo…
-
Unscored —
Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perfor…
-
Unscored —CVE-2021-30538 EPSS 16%
Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass c…
-
Unscored —
Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack …
-
Unscored —CVE-2021-30535 Public exploit
Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corrupt…
-
Medium 6.5
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…
KEV Jun 27, 2022 -
Unscored —
Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to by…
-
Unscored —
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote atta…
-
Unscored —
Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out…
-
Unscored —
Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a ma…
-
Unscored —
Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to inst…
-
Unscored —
Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install …
-
Unscored —
Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a…
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap…
-
Unscored —
Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform…
-
Unscored —
An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held l…
-
Unscored —
An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hc…
-
Unscored —
An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_f…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_…
-
Medium 5.3
Observable Response Discrepancy in Flask-AppBuilder
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when y…
-
Unscored —
Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect…