Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
291 results · Clear filters · Feed
-
Medium 5.3
Denial of service in Valine
Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
-
Medium 5.4CVE-2021-21668 EPSS 76%
Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
-
Medium 5.4CVE-2021-21667 EPSS 76%
Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
-
Medium 6.0
Insecure Storage of Sensitive Information in myQNAPcloud Link
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects…
-
Medium 4.3
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Fi…
-
Medium 6.5
Session Fixation in Nextcloud Talk
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended tha…
-
Medium 5.4
IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting. This vulnerability allows …
-
Medium 6.2
Missing Handler in @scandipwa/magento-scripts
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't impleme…
-
Medium 6.3
Stored XSS vulnerability in Ellipse APM
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hi…
-
Medium 6.1
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer…
-
Medium 6.1
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffe…
-
Medium 6.1
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS c…
-
Medium 6.5
Possible DoS attack using a special crafted URL in email body
DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.…
-
Medium 5.5
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
-
Medium 5.5
A carefully crafted PDF file can trigger an infinite loop while loading the file
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
-
Medium 5.2
apport process_report() arbitrary file write
It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
-
Medium 6.1
Possible Open Redirect Vulnerability in Action Pack
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a mal…
-
Medium 5.3
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…
-
Medium 6.0
Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-…
-
Medium 6.0
Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reade…
-
Medium 6.5
Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an un…
-
Medium 5.3
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and …
-
Medium 5.3
A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.…
-
Medium 6.8
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab a…
KEV Feb 18, 2026 -
Medium 6.1
Drupal Core Cross-site scripting vulnerability
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior …
-
Medium 4.0
Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged a…
-
Medium 6.4CVE-2021-25394 Exploited
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…
KEV Jun 29, 2023 -
Medium 4.0
Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privilege…
-
Medium 6.8
An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write…
-
Medium 4.0
Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers …
-
Medium 6.4CVE-2021-25395 Exploited
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check…
KEV Jun 29, 2023 -
Medium 6.6
Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get p…
-
Medium 6.7
An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory writ…
-
Medium 4.2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when usin…
-
Medium 6.5
IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing …
-
Medium 4.0
IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can …
-
Medium 5.4
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
KEV Nov 28, 2025 -
Medium 5.4
Open Redirect
This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulner…
-
Medium 6.8
Specific cstrings input may not be properly validated in the Go Driver
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue aff…
-
Medium 4.8
Incorrect permissions on McAfee Agent for Windows event folder
Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder. This allows a local user to either add false events or remove events from the event logs prior to th…