Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
1,584 results · Feed
-
Unscored —
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access …
-
Unscored —
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level…
-
Unscored —
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&us…
-
Unscored —
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. Th…
-
Unscored —
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create…
-
Unscored —
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in …
-
Medium 4.4
Remote Code Execution via unsafe classes in otherwise permitted modules
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined …
-
Unscored —
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All…
-
Unscored —
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All…
-
Medium 5.0
Reflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.65
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLen…
-
Medium 4.3
SendGrid <= 1.11.8 – Authorization Bypass
The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versio…
-
Unscored —
A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting v…
-
Unscored —
It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectl…
-
Unscored —
Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across d…
-
Unscored —
Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of…
-
Unscored —
Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service a…
-
Unscored —
textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have suffic…
-
Critical 9.8
IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an …
-
Medium 5.0
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the sy…
-
Unscored —
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query s…
-
Unscored —
app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON f…
-
Unscored —
app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster r…
-
High 7.8CVE-2021-36742 Exploited
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free …
KEV Nov 3, 2021 -
High 8.8CVE-2021-36741 Exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Fre…
KEV Nov 3, 2021 -
Unscored —
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
-
Unscored —
When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the…
-
Unscored —
An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for…
-
Unscored —
A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.p…
-
Unscored —
A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php wi…
-
Medium 6.3
XML External Entity (XXE) Injection
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
-
Unscored —
CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and use…
-
Unscored —
Sourcecodester Phone Shop Sales Managements System version 1.0 suffers from a remote SQL injection vulnerability that a…
-
Unscored —
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is …
-
Unscored —
SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.
-
High 7.8
Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vul…
-
Critical 9.6
Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerabilit…
-
High 8.8
The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for …
-
Medium 6.1
Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vuln…