Archive
23 June 2021
Vulnerabilities first published on this day (UTC), newest first.
37 results · Feed
-
Unscored —
The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A mal…
-
Low 3.7
Potential Denial-of-Service in bindata
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinDa…
-
High 8.8
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vuln…
-
Unscored —
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the applica…
-
Unscored —
Out-of-bounds Read in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application wit…
-
Unscored —
Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application wit…
-
Unscored —
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the applica…
-
Unscored —
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the applica…
-
Unscored —
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this …
-
High 8.2
Moodle command execution vulnerability exists in the default legacy spellchecker plugin
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
-
Unscored —
GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter.
-
Unscored —
Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameter…
-
Unscored —
Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in admin/changedata.php via the redirect_url paramet…
-
Unscored —
A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or H…
-
Medium 6.4
Unchecked hostname resolution could allow access to local network resources by users outside the local network
### Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that wou…
-
High 7.5
XXE vulnerability on Launch import with externally-defined DTD file
Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a u…
-
Critical —
Auth bypass in SAML provider
### Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider: - [`goxmldsig` - Signature Validation Bypass](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) - [`gosaml2`…
-
Unscored —
This project is related to Opigno LMS distribution. It implements the group manager in the Opigno LMS. The module does …
-
Unscored —
This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very f…
-
Unscored —CVE-2021-33624 Public exploit
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confus…
-
Unscored —
SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.
-
Unscored —
Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippe…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.
-
Unscored —
phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php o…
-
Unscored —
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file …
-
Unscored —CVE-2021-28976 Public exploit
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.
-
Unscored —CVE-2021-31586 EPSS 44%
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.
-
Unscored —
Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH pas…
-
Unscored —
VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware Ap…
-
Unscored —CVE-2021-21998 EPSS 11%
VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A ma…
-
High 7.5
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Sec…
-
High 8.6
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in fil…
-
High 7.5
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Critical 9.8
Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-254…
-
Medium 5.3
Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Ma…
-
Medium 6.1
Cross site scripting in the system log
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.