Archive
22 June 2021
Vulnerabilities first published on this day (UTC), newest first.
104 results · Feed
-
Low 1.9
Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denia…
-
Low 3.0
Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite …
-
Low 3.9
Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a r…
-
Medium 4.2
Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream dese…
-
Medium 4.2
Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not ex…
-
Medium 4.4
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem functio…
-
Medium 5.3
Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an …
-
Medium 5.3
Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an …
-
High 8.2
Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA OTE protoco…
-
Unscored —
pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on …
-
High 7.5
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` …
-
Critical 9.1
Supply chain attack via MiTM against users
Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS…
-
Medium 6.5
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious use…
-
Unscored —
There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20S…
-
Unscored —
Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and…
-
Unscored —
There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specif…
-
Unscored —
There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently.…
-
Unscored —
There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. There is a timing window exists in w…
-
Unscored —
There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC50…
-
Unscored —
There is an out-of-bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. T…
-
Unscored —
There is an out of bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. A…
-
Medium 6.4CVE-2021-32644 Public exploit
Cross-site Scripting in Random.php
Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unles…
-
Unscored —
There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200…
-
Critical 9.8
Cortex XSOAR: Unauthorized Usage of the REST API
An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 bu…
-
Unscored —
Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parame…
-
Medium 6.5
Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Secur…
-
Low 2.9CVE-2021-34428 Public exploit
SessionListener can prevent a session from being invalidated breaking logout
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple con…
-
Unscored —
Cross Site Request Forgery (CSRF) in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component …
-
Unscored —
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/none…
-
Unscored —
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/publ…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple area…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unau…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\check_availability.php. Rem…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unau…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php. Remote…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a Persistent Cross-Site Scripting vulnerability in \hms\admin\app…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote u…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\appointment-history.php. Re…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\registration.php. Remote un…
-
Unscored —
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unau…