Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application…
-
Unscored —
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerabil…
-
Unscored —
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerabi…
-
Unscored —
A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulner…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua wit…
-
Unscored —
Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent…
-
Unscored —CVE-2021-28958 EPSS 73%
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing…
-
Critical 9.9
Command Injection Vulnerability in Fidelis Network and Deception
Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an…
-
Medium 6.5
User Credentials Stored in a Recoverable Format within Fidelis Network and Deception
User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present i…
-
Critical 9.9
Privileged Command Injection Vulnerability in Fidelis Network and Deception
Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is…
-
Critical 9.8
Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception
Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in…
-
Unscored —CVE-2021-35475 Public exploit
SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when …
-
Unscored —
In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessib…
-
Unscored —
ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running …
-
High 7.5
Private files publicly accessible with Cloud Storage providers
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility acco…
-
Medium 4.4
Internal hidden fields are visible on to many associations in admin api
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the u…
-
Medium 5.3
Information leakage in Error Handler
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directl…
-
Medium 4.8
Authenticated Stored XSS
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updat…
-
Critical 9.1
Leak of information via Store-API
Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API …
-
Medium 5.9
Potential Session Hijacking in Shopware
Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via th…
-
Unscored —CVE-2021-35448 Public exploit
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by usin…
-
Unscored —
Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonst…
-
Unscored —
An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows at…
-
Unscored —
An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers f…
-
Medium 4.9
Creation of order credits was not validated by acl in admin orders
Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via t…
-
Medium 5.3
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circu…
-
High 7.5
Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server termin…
-
Medium 5.9
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user wh…
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite a…
-
Medium 6.2
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change th…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafte…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via craf…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted d…
-
Unscored —
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via …
-
Unscored —
Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arb…
-
Unscored —
Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.
-
Unscored —
The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied fil…