Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Medium 6.5
Authentication bypass in SilverStripe GraphQL
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
-
Medium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker…
-
Medium 6.1
An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XS…
-
Unscored —
Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote use…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions startin…
-
High 8.6
UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
-
Critical 9.8
Unauthenticated arbitrary file upload and command execution in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by call…
-
Medium 4.4
All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all…
-
Critical 10.0
Unauthenticated remote command execution with SYSTEM privileges in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
-
Critical 9.8
Unauthenticated remote command execution in Vembu products
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
-
Medium 4.7
Sensitive data may not be removed from storage on account removal
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End e…
-
Medium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker…
-
High 7.1
Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation…
-
High 8.2
Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A…
-
High 8.8
A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to lea…
-
Unscored —
Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Pass…
-
Medium 4.8
SilverStripe XXE Vulnerability in CSSContentParser
SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving ext…
-
Medium 4.9
Path Traversal in Django
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the…
-
High 8.8
Remote Code Execution via traversal in TAL expressions
Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules…
-
Medium 5.3
FormField with square brackets in field name skips validation
In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
-
High 8.8
Remote Command Execution in reg-keygen-git-hash-plugin
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 o…
-
Unscored —
In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentiall…
-
High 7.5
An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak informati…
-
Unscored —
Bypass network access control
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made …
-
Low 2.6
All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and al…
-
Medium 6.8
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab C…
-
Unscored —
VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memo…
-
Unscored —
EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consu…
-
Unscored —
Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.…
-
Unscored —
SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file sup…
-
Medium 6.5
Enclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer
An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
-
Medium 6.5
Arbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall
An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
-
Medium 6.5
Arbitrary enclave memory overread vulnerability in Asylo TrustedPrimitives::UntrustedCall
An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommend…
-
Unscored —
An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remem…
-
Unscored —
A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to pe…
-
Medium 5.4
Cross-site scripting in ICEcoder
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
-
Unscored —
A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger a…
-
Medium 4.0
ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' character…
-
Unscored —
A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user …
-
Unscored —
An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could …