Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a bro…
-
Unscored —
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License M…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could a…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable for…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to…
-
High 7.5
Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prio…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange proc…
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a maliciou…
-
Unscored —
An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can use kw/auth…
-
Unscored —
The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over c…
-
Unscored —
Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in cer…
-
Unscored —
SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could e…
-
High 7.5CVE-2021-33813 EPSS 19%
XML External Entity (XXE) Injection in JDOM
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
-
Unscored —
A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker…
-
Unscored —CVE-2021-20093 EPSS 33%
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker …
-
High 7.5
XSS in the ticket overview screens
There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any us…
-
Critical 9.8
Java deserialization in Chainsaw
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
-
Medium 6.0
Insecure Storage of Sensitive Information in myQNAPcloud Link
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects…
-
Medium 4.3
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Fi…
-
Critical 9.8
Improper Verification of Cryptographic Signature in tenvoy
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns …
-
Medium 6.5
Session Fixation in Nextcloud Talk
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended tha…
-
High 8.1
Opencast vulnerable to billion laughs attack (XML bomb)
Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attac…
-
Critical 9.8
Use After Free in Hermes
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application us…
-
Unscored —
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie.
-
Unscored —
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can moni…
-
Unscored —
Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially expl…
-
Unscored —
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to instal…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corr…
KEV Nov 3, 2021 -
Unscored —
Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to ins…
-
Unscored —
Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to insta…
-
Unscored —
Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap …
-
Unscored —
Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform o…
-
Unscored —
Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the …
-
Unscored —
Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap…
-
Unscored —
A Cross Site Scripting in SourceCodester Employee Management System 1.0 allows the user to execute alert messages via /…
-
Unscored —CVE-2020-29214 Scanner template
SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to byp…
-
Unscored —
SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote acces…
-
High 7.3
Prototype Pollution
This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.