Archive
16 June 2021
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
Unscored —
SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.
-
High 7.5
Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as…
-
Medium 4.4
IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or non…
-
Unscored —
This module provides a revision UI to Block Content entities. The module doesn't sufficiently respect access restrictio…
-
Medium 5.9
IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hig…
-
High 7.5
IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users …
-
Medium 5.3
IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted…
-
Unscored —
This module provides a revision UI to Linky entities. The module doesn't sufficiently respect access restrictions to ce…
-
Unscored —
Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, its 8.x-3.x branch is a start fro…
-
Unscored —
bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely).
-
Unscored —
bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php f…
-
Unscored —
bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code.
-
Unscored —
bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files.
-
High 7.5
Prototype pollution in supermixer
Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
-
Unscored —
Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infect…
-
Unscored —
In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize…
-
Unscored —
SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.
-
Unscored —
TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.
-
Critical 9.0
SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, doe…
-
Medium 5.3
Denial of service in Valine
Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
-
Medium 5.4CVE-2021-21668 EPSS 76%
Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
-
Medium 5.4CVE-2021-21667 EPSS 76%
Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
-
Unscored —
Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.…
-
Unscored —CVE-2020-8300 Public exploit
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-…
-
Unscored —
Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive info…
-
Unscored —
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-messa…
-
Unscored —
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a bro…
-
Unscored —
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License M…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could a…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable for…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to…
-
High 7.5
Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prio…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange proc…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a maliciou…
-
Unscored —
An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can use kw/auth…
-
Unscored —
The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over c…
-
Unscored —
Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in cer…
-
Unscored —
SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could e…
-
High 7.5CVE-2021-33813 EPSS 19%
XML External Entity (XXE) Injection in JDOM
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.