Archive
19 July 2021
Vulnerabilities first published on this day (UTC), newest first.
61 results · Feed
-
Medium 6.1
Confused deputy attack in sandbox module resolution
Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their inte…
-
Critical 9.8
Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential …
-
Medium 5.4
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to …
-
Critical 9.1
Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A r…
-
High 7.6
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to …
-
Critical 9.0
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to …
-
High 8.8
Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. Proxy server user p…
-
Medium 4.1
Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated at…
-
Medium 6.4
Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X envir…
-
Unscored —
An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax…
-
Unscored —
PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control.…
-
Unscored —
A remote denial of service (DoS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in vers…
-
Unscored —
A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v…
-
Unscored —
An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users' private key after…
-
Unscored —
Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authe…
-
Unscored —
Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP…
-
Unscored —
Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for…
-
Unscored —
A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system cra…
-
Unscored —
Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports.
-
Unscored —
Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation.
-
Unscored —CVE-2021-36799 Public exploit
KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local us…
-
Unscored —
In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device…
-
Unscored —
Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenti…
-
Medium 4.7
IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should n…
-
High 8.4
IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges t…
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows user…
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows user…
-
Unscored —
GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image.
-
Medium 6.1
Cross-site Scripting in OWASP AntiSamy
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
-
Unscored —
Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can stat…
-
Unscored —
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Serv…
-
Unscored —
Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure …
-
Unscored —CVE-2021-35449 Public exploit
The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below…
-
Unscored —
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary…
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
-
Medium 5.5
Denial of Service in SheetsJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
-
Unscored —
Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route …
-
Unscored —CVE-2021-3279 Public exploit
sz.chat version 4 allows injection of web scripts and HTML in the message box.