Archive
June 2021
Vulnerabilities first published in this month (UTC), newest first.
1,711 results · Feed
-
Unscored —
Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perfo…
-
High 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local acc…
-
High 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local acc…
-
High 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local acc…
-
Medium 5.9
Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper c…
-
Critical 9.8CVE-2021-32708 Public exploit
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The condition…
-
High 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint…
-
Unscored —
SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.
-
Unscored —
Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.
-
Unscored —
phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
-
Unscored —
In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.
-
Unscored —
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.p…
-
Unscored —
In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
-
Critical —
JFinal Java Deserialization Vulnerability
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
-
Unscored —
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
-
Unscored —
There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use thi…
-
Unscored —CVE-2020-18662 Public exploit
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
-
Medium 6.1
Cross-site Scripting (XSS)
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
-
Unscored —
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
-
Unscored —
In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file…
-
Medium 6.1
Cross-site scripting in jfinal
An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.
-
Medium 5.3
exacqVision Web Service CSS
exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
-
Medium 4.3
exacqVision Enterprise Manager CSS
exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
-
Unscored —
If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her ke…
-
Unscored —
Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may cre…
-
Unscored —
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker …
-
Unscored —
A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vu…
-
Unscored —
When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with…
-
Unscored —
By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, re…
-
Unscored —
Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We …
-
Unscored —
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS pa…
-
Unscored —
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and g…
-
Unscored —
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when…
-
Unscored —
A compromised content process could have performed session history manipulations it should not have been able to due to…
-
Unscored —
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been int…
-
Unscored —
Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy preve…
-
Unscored —
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash…
-
Unscored —
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking r…