Archive
2 July 2021
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Unscored —
An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attac…
-
Unscored —
Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information …
-
High 7.3
Prototype Pollution
All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
-
High 7.3
Prototype Pollution
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
-
High 7.2
Server-Side Request Forgery (SSRF) in emissary:emissary
Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerab…
-
High 7.1
Cross-site scripting (XSS) from field and configuration text displayed in the Panel
Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. …
-
Unscored —
A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to exe…
-
Unscored —
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is…
-
Unscored —
An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker me…
-
Unscored —
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provi…
-
Unscored —
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppr…
-
Unscored —
An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module doe…
-
Unscored —
An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related speci…
-
Unscored —
An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a pri…
-
Unscored —
An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of …
-
Unscored —
OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL conf…
-
Unscored —
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL …
-
Unscored —
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintende…
-
Unscored —
Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an atta…
-
Unscored —
Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project…
-
Critical 9.8
An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versi…
-
Critical 9.8
SQL Injection in Django
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
-
Medium 6.5
Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…