Archive
21 June 2021
Vulnerabilities first published on this day (UTC), newest first.
82 results · Feed
-
Unscored —
Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwis…
-
Unscored —
Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary s…
-
High 7.8
Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a pro…
-
Unscored —
Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to pr…
-
Unscored —
Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive …
-
Medium 5.0
Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorr…
-
Medium 6.3
Bootloader contains a vulnerability in NVIDIA TegraBoot where a potential heap overflow might allow an attacker to cont…
-
Medium 6.3
The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where t…
-
Medium 6.3
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calloc size calculation c…
-
Medium 6.8
Blind Server-Side Request Forgery (SSRF) in eLabFTW
eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW…
-
High 7.5
ReDOS in Vfsjfilechooser2
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attempts to validate crafted URIs.
-
Unscored —
An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a R…
-
Unscored —CVE-2021-24383 Public exploit
WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
-
Unscored —
Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any…
-
Unscored —
Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript co…
-
Unscored —
Autoptimize < 2.7.8 - Race Condition leading to RCE
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in betw…
-
Unscored —
Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zi…
-
Medium 5.3
Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that…
-
Unscored —
WP Hardening < 1.2.2 - Reflected XSS via historyvalue
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
-
Unscored —
WP Hardening < 1.2.2 - Reflected XSS via URI
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
-
Unscored —
GetPaid < 2.3.4 - Authenticated Stored XSS
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img…
-
Unscored —
WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
-
Medium 5.4
Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the …
-
Unscored —
Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)
The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
-
Unscored —
GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL Injections
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
-
Unscored —
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
-
Unscored —
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
-
Unscored —
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.
-
High 8.1
XSS Vulnerability in mongo-express
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row wi…
-
Medium 6.5
Form validation can be skipped
neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that t…
-
Unscored —
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Adm…
-
Unscored —
Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
-
Unscored —
malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code i…
-
Unscored —
In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local es…
-
Unscored —
In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to loca…
-
Unscored —
In memory management driver, there is a possible memory corruption due to a use after free. This could lead to local es…
-
Unscored —
In memory management driver, there is a possible memory corruption due to improper locking. This could lead to local es…
-
Unscored —
In memory management driver, there is a possible memory corruption due to a double free. This could lead to local escal…
-
Unscored —
In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to loca…
-
Unscored —
In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local es…