Archive
29 June 2021
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Critical —
Denial of service in go-ethereum due to CVE-2020-28362
### Impact Versions of Geth built with Go `<1.15.5` or `<1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’. We recommend all users to rebuild (ideally `v1…
-
Unscored —CVE-2021-35941 EPSS 13%
Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that c…
-
Unscored —
There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers w…
-
Unscored —
There has a license management vulnerability in some Huawei products. An attacker with high privilege needs to perform …
-
Unscored —
There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. A module does not perform the strict op…
-
Unscored —
There is a multiple threads race condition vulnerability in Huawei product. A race condition exists for concurrent I/O …
-
Medium 4.7
URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux
PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected…
-
Unscored —
There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request …
-
Critical 9.9
Remote Code Execution Vulnerability in Session Storage
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's appl…
-
Medium 6.5
Client side sessions should not allow unencrypted storage
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session…
-
Unscored —
Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessu…
-
Medium 4.4
Default client side session signing key is highly predictable
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not al…
-
Unscored —
Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
-
High 8.8
TIBCO Spotfire Windows Platform Artifact Search vulnerability
The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire …
-
High 8.8
TIBCO Spotfire Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplac…
-
Unscored —
SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parame…
-
High 7.5CVE-2021-22119 Public exploit
Resource Exhaustion in Spring Security
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux app…
-
Medium 4.3
IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to ex…
-
Medium 4.0
IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure f…
-
Medium 5.4
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Unscored —
Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' …
-
Unscored —
Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of…
-
Unscored —
Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file atta…
-
Unscored —
Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.
-
Unscored —
Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This…
-
High 8.8
A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. A specially craf…
-
Unscored —
FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an atta…
-
Unscored —
FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory…
-
Unscored —
FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attac…
-
High 7.0
Cached redirect poisoning via X-Forwarded-Host header
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` head…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninj…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninj…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…