Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) r…
-
High 8.1
Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defi…
-
Unscored —
An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) re…
-
Unscored —
An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Ve…
-
Unscored —
Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XS…
-
Unscored —
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent…
-
Unscored —
Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an …
-
High 8.6
An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2…
-
Unscored —
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
-
Unscored —
In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHA…
-
Unscored —
Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulti…
-
Unscored —
An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 202…
-
Unscored —
An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022…
-
Unscored —
An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4…
-
Medium 6.3
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1…
-
Medium 6.8
Repository credentials passed to alternate domain
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain…
-
High 8.8
Auto-merging Person Records Compromised
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This…
-
Medium 5.4
Cross-site scripting in PageKit
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website p…
-
Medium 5.4
Moodle Cross Site Scripting (XSS)
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
-
Unscored —
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
-
Unscored —
D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the devi…
-
Unscored —
D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some p…
-
Unscored —
D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, …
-
Unscored —
There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permiss…
-
Medium 6.5
Automatic room upgrade handling can be used maliciously to bridge a room non-consentually
Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a n…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /inst…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication th…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to t…
-
Unscored —
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the i…
-
Unscored —
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
-
Unscored —CVE-2020-22211 Scanner template
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
-
Unscored —CVE-2020-22210 Scanner template
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
-
Unscored —CVE-2020-22209 Scanner template
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
-
Medium 4.7
Cisco Unified Intelligence Center Reflected Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the we…
-
High 7.2
Cisco Small Business 220 Series Smart Switches Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Co…
-
High 7.2
Cisco Small Business 220 Series Smart Switches Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Co…
-
High 7.4
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic betw…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability
A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the A…
-
Medium 5.5
Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability
A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. This vulnerability is due to uncontrolled memory allocation. An attacker co…