Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —CVE-2021-0481 Public exploit
In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpec…
-
Unscored —
In BinderDiedCallback of MediaCodec.cpp, there is a possible memory corruption due to a use after free. This could lead…
-
Unscored —
In /proc/net of the kernel filesystem, there is a possible information leak due to a permissions bypass. This could lea…
-
Unscored —
The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution …
-
Unscored —
The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary c…
-
Unscored —
The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change…
-
Unscored —
The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information…
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the PSD read_icc_icCurve_data functionality of Accusoft ImageGear …
-
High 8.1
A memory corruption vulnerability exists in the PNG png_palette_process functionality of Accusoft ImageGear 19.9. A spe…
-
High 8.1
An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A speci…
-
Critical 9.8
An improper array index validation vulnerability exists in the TIF IP_planar_raster_unpack functionality of Accusoft Im…
-
Unscored —
Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all…
-
Unscored —
Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for…
-
Unscored —
Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to per…
-
High 7.5
Denial of Service in Action Dispatch
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause t…
-
High 7.5
Possible DoS Vulnerability in Action Controller Token Authentication
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_requ…
-
Unscored —CVE-2021-22901 EPSS 64%
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used whe…
-
Medium 6.1
Possible Open Redirect Vulnerability in Action Pack
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a mal…
-
Unscored —
Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authe…
-
Unscored —
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate v…
-
Medium 5.3
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…
-
Unscored —
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 …
-
Unscored —
Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the l…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…
-
Unscored —
Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utili…
-
Medium 6.0
Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-…
-
High 8.1
Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configur…
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP…
-
Critical 9.9
Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an…
-
Medium 6.0
Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reade…
-
Critical 9.9
A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command C…
-
Medium 6.5
Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an un…
-
High 7.7
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recu…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) …
-
Critical 9.8
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…
-
Critical 9.8
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…
-
Critical 9.8
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…
-
Medium 5.3
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and …
-
High 7.5
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…
-
Medium 5.3
A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.…