Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
299 results · Clear filters · Feed
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.
-
High 8.6
Unsafe loopback forwarding interface in Restund
Restund is an open source NAT traversal server. The restund TURN server can be instructed to open a relay to the loopback address range. This allows you to reach any other service running on localhost which you might consider private. In the configuration tha…
-
High 7.8
UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specif…
-
High 8.1
A memory corruption vulnerability exists in the PNG png_palette_process functionality of Accusoft ImageGear 19.9. A spe…
-
High 8.1
An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A speci…
-
High 7.5
Denial of Service in Action Dispatch
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause t…
-
High 7.5
Possible DoS Vulnerability in Action Controller Token Authentication
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_requ…
-
High 8.1
Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configur…
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP…
-
High 7.7
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recu…
-
High 7.5
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…
-
High 8.8
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
-
High 7.1
Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary …
-
High 8.8
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and ex…
KEV Dec 3, 2025 -
High 7.8
Inclusion of Sensitive Information in QSS
Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 …
-
High 8.8
Improper Access Control Vulnerability in Helpdesk
An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4.
-
High 8.8
apport can be stalled by reading a FIFO
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
-
High 8.8
apport improperly parses /proc/pid/stat
It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
-
High 8.8
apport improperly parses /proc/pid/status
It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
-
High 7.3
DLL preload vulnerability in McAfee Agent for Windows
A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this vulnerability, the at…
-
High 8.0
CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/pa…
-
High 7.8
Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation
A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to crea…
-
High 7.8
Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable e…
-
High 8.2
Cross-Site Request Forgery (CSRF) in FastAPI
FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cro…
-
High 8.3
Reflected XSS in page parameter
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
-
High 8.3
Improper Input Validation of HTTP Headers
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.
-
High 8.3
Reflected XSS in URL handler
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context o…
-
High 8.8
An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0.…
-
High 7.8
Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecu…
-
High 8.8
Out of bounds write vulnerability in McAfee GetSusp
Memory corruption vulnerability in the driver file component in McAfee GetSusp prior to 4.0.0 could allow a program being investigated on the local machine to trigger a buffer overflow in GetSusp, leading to the execution of arbitrary code, potentially trigge…
-
High 8.8
Circutor SGE-PLC1000 improper authentication
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network wh…
-
High 7.5
Reachable assertion is possible while processing peer association WLAN message from host and nonstandard incoming packe…
-
High 8.4
Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto, Snapdra…
-
High 7.8
Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdra…
-
High 7.8
Possible out of bound read in DRM due to improper buffer length check. in Snapdragon Auto, Snapdragon Compute, Snapdrag…
-
High 7.8
While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared mem…
-
High 7.8
Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon …
-
High 8.4
Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value…
-
High 7.8CVE-2020-11261 Exploited
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size…
KEV Dec 1, 2021 -
High 7.5
SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT,…