Archive
8 June 2021
Vulnerabilities first published on this day (UTC), newest first.
108 results · Feed
-
High 7.8
3D Viewer Remote Code Execution Vulnerability
3D Viewer Remote Code Execution Vulnerability
-
High 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Office Graphics Remote Code Execution Vulnerability
-
High 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Office Graphics Remote Code Execution Vulnerability
-
High 7.8CVE-2021-31939 EPSS 13%
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
High 7.3
Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability
Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability
-
Medium 5.2CVE-2021-31199 Exploited
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Medium 5.2CVE-2021-31201 Exploited
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.1
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 7.8
Windows Print Spooler Remote Code Execution Vulnerability
Windows Print Spooler Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Medium 4.8
Windows DCOM Server Security Feature Bypass
Windows DCOM Server Security Feature Bypass
-
Unscored —
A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). The configuration of the SAML module…
-
Unscored —
The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 befo…
-
Unscored —
The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before…
-
Unscored —
A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions …
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.1.0.3), Teamcenter Visualization (All versions < V13.1…
-
Unscored —
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All…
-
Unscored —
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All…
-
Medium 6.5
Authentication bypass in SilverStripe GraphQL
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
-
Medium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker…
-
Medium 6.1
An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XS…
-
Unscored —
Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote use…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions startin…
-
High 8.6
UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
-
Critical 9.8
Unauthenticated arbitrary file upload and command execution in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by call…
-
Medium 4.4
All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all…
-
Critical 10.0
Unauthenticated remote command execution with SYSTEM privileges in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
-
Critical 9.8
Unauthenticated remote command execution in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
-
Medium 4.7
Sensitive data may not be removed from storage on account removal
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End e…
-
Medium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker…
-
High 7.1
Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation…
-
High 8.2
Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A…
-
High 8.8
A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to lea…
-
Unscored —
Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Pass…
-
Medium 4.8
SilverStripe XXE Vulnerability in CSSContentParser
SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving ext…
-
Medium 4.9
Path Traversal in Django
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the…
-
High 8.8
Remote Code Execution via traversal in TAL expressions
Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules…
-
Medium 5.3
FormField with square brackets in field name skips validation
In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
-
High 8.8
Remote Command Execution in reg-keygen-git-hash-plugin
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 o…
-
Unscored —
In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentiall…
-
High 7.5
An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak informati…