Archive
1 July 2021
Vulnerabilities first published on this day (UTC), newest first.
57 results · Feed
-
Unscored —
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" f…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary we…
-
Medium 5.3
The reset password form reveal users email address
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem h…
-
Medium 5.7
No CSRF protection on the password change form
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, wh…
-
Low 2.0
A user without PR can reset user authentication failures information
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be …
-
Unscored —
An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged use…
-
Unscored —
An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information withi…
-
Medium 5.4
IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability al…
-
Medium 6.3
IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could se…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated …
-
Unscored —
Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated use…
-
Unscored —
An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.
-
High 8.8
Facility Explorer
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sendin…
-
High 8.8
C-CURE 9000
An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.
-
Unscored —
Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any at…
-
Unscored —CVE-2021-35336 EPSS 10%
Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web …
-
Unscored —
When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plu…
-
Unscored —CVE-2021-31813 EPSS 78%
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details …
-
Unscored —
There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability…
-
Unscored —
There is a Configuration Defect vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may a…
-
Unscored —
There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability m…
-
Unscored —
There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability m…
-
Unscored —
Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access res…
-
Unscored —
Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary sc…
-
Unscored —
UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdEx…
-
Unscored —
UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from…
-
Unscored —
RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable.
-
Unscored —
LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).
-
Unscored —
LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1…
-
High 8.8
libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
-
Unscored —
uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTr…
-
Unscored —
Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken.
-
Unscored —
Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.
-
Unscored —
HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).
-
Unscored —
Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf6…