Archive
24 June 2021
Vulnerabilities first published on this day (UTC), newest first.
103 results · Feed
-
High 7.5
Private files publicly accessible with Cloud Storage providers
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility acco…
-
Medium 4.4
Internal hidden fields are visible on to many associations in admin api
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the u…
-
Medium 5.3
Information leakage in Error Handler
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directl…
-
Medium 4.8
Authenticated Stored XSS
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updat…
-
Critical 9.1
Leak of information via Store-API
Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API …
-
Medium 5.9
Potential Session Hijacking in Shopware
Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via th…
-
Unscored —CVE-2021-35448 Public exploit
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by usin…
-
Unscored —
Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonst…
-
Unscored —
An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows at…
-
Unscored —
An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers f…
-
Medium 4.9
Creation of order credits was not validated by acl in admin orders
Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via t…
-
Medium 5.3
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circu…
-
High 7.5
Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server termin…
-
Medium 5.9
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user wh…
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite a…
-
Medium 6.2
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change th…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafte…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via craf…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted d…
-
Unscored —
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via …
-
Unscored —
Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arb…
-
Unscored —
Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.
-
Unscored —
The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied fil…
-
Unscored —
Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perfo…
-
High 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local acc…
-
High 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local acc…
-
High 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local acc…
-
Medium 5.9
Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper c…
-
Critical 9.8CVE-2021-32708 Public exploit
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The condition…
-
High 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint…
-
Unscored —
SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.
-
Unscored —
Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.
-
Unscored —
phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
-
Unscored —
In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.
-
Unscored —
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.p…
-
Unscored —
In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.