Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability m…
-
Unscored —
There is a Memory Buffer Improper Operation Limit vulnerability in Huawei Smartphone. Successful exploitation of this v…
-
Unscored —
There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability ma…
-
Unscored —
There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vuln…
-
Medium 6.8
TechDocs object element script injection
Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding…
-
Medium 6.8
TechDocs content sanitization bypass
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation c…
-
Unscored —
There is an Improper Control of Generation of Code vulnerability in Huawei Smartphone. Successful exploitation of this …
-
Unscored —
There is a Credentials Management Errors vulnerability in Huawei Smartphone. Successful exploitation of this vulnerabil…
-
Unscored —
There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability ma…
-
Unscored —
There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Successful exploitation of …
-
Unscored —
There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Attackers with physical acc…
-
Unscored —
There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability ma…
-
Unscored —
There is a Security Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impa…
-
Unscored —
There is a Business Logic Errors vulnerability in Huawei Smartphone. The malicious apps installed on the device can kee…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
-
Medium 5.3
IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain s…
-
Unscored —
Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.
-
Unscored —
WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because t…
-
Medium 5.9
When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the…
-
Unscored —
The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted dat…
-
Unscored —
Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window …
-
Unscored —
A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. …
-
Unscored —
A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scri…
-
Unscored —
MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change reques…
-
High 7.4
Invalid session token expiration
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fi…
-
Unscored —
The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability …
-
High 7.8
An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access …
-
Medium 6.7
A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 …
-
Medium 5.9
Cross site Scripting (XSS) vulnerability in McAfee DBSec
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. Thi…
-
Medium 4.9
Incorrect access to deleted scripts vulnerability in McAfee DBSec
Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to signed SQL scripts which have been marked as deleted or expired within the administrative console. Th…
-
High 8.8
Command Injection Vulnerability in Video Station
A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.…
-
High 7.7
Post-Authentication Reflected XSS Vulnerability in Q'center
A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of…
-
Medium 5.7
DOM-Based XSS Vulnerability in QTS and QuTS hero
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QN…
-
Unscored —
dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly …
-
Unscored —
FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background …
-
Unscored —
FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.c…
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows user…
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows user…
-
Medium 4.3
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an …
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow a…