Archive
16 June 2021
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
Medium 6.3
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
Medium 6.8
Repository credentials passed to alternate domain
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain…
-
High 8.8
Auto-merging Person Records Compromised
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This…
-
Medium 5.4
Cross-site scripting in PageKit
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website p…
-
Medium 5.4
Moodle Cross Site Scripting (XSS)
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
-
Unscored —
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
-
Unscored —
D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the devi…
-
Unscored —
D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some p…
-
Unscored —
D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, …
-
Unscored —
There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permiss…
-
Medium 6.5
Automatic room upgrade handling can be used maliciously to bridge a room non-consentually
Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a n…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /inst…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication th…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to t…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the i…
-
Unscored —
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
-
Unscored —
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
-
Unscored —
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
-
Unscored —
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
-
Medium 4.7
Cisco Unified Intelligence Center Reflected Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the we…
-
High 7.2
Cisco Small Business 220 Series Smart Switches Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Co…
-
High 7.2
Cisco Small Business 220 Series Smart Switches Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Co…
-
High 7.4
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic betw…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability
A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the A…
-
Medium 5.5
Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability
A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. This vulnerability is due to uncontrolled memory allocation. An attacker co…
-
Medium 6.5
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. For more information about these vulnerabil…
-
Medium 6.5
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. For more information about these vulnerabil…
-
High 7.2
Cisco Small Business 220 Series Smart Switches Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Co…
-
Unscored —CVE-2020-22208 EPSS 10%
SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
-
High 7.2
Cisco Small Business 220 Series Smart Switches Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Co…
-
Medium 4.3
Cisco Meeting Server API Denial of Service Vulnerability
A vulnerability in the API of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because requests that are sent to the API are not properly validated…
-
High 8.1
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
-
Unscored —
SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.
-
Unscored —
SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.
-
Unscored —
SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. .
-
Unscored —
Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve a…
-
Unscored —
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.
-
Unscored —
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/produ…
-
Unscored —
Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.