Archive
22 July 2021
Vulnerabilities first published on this day (UTC), newest first.
90 results · Feed
-
Unscored —
An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denia…
-
Unscored —
An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial…
-
Unscored —
A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 an…
-
Unscored —
An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service …
-
Unscored —
A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1…
-
Unscored —
A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 a…
-
Unscored —
A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version an…
-
Unscored —
SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL…
-
Unscored —
Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code,…
-
Unscored —
SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitra…
-
Unscored —
SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbi…
-
Unscored —
SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitra…
-
Unscored —
Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitr…
-
Unscored —
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attack…
-
Unscored —
Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject a…
-
Unscored —
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execut…
-
Medium 6.5
Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection
By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
-
Medium 6.5
Ivanti MobileIron Core clish Restricted Shell Escape via OS Command Injection
By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
-
High 7.9
Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interface
The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian O…
-
High 8.7
Akkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' command
The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to `exec` and providing the ssh client a single execution parameter. This issue was resolved in Akkadian OVA appliance ve…
-
High 8.2
Akkadian Provisioning Manager Engine (PME) Hard-Coded Credentials
Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance …
-
Medium 4.6
Sage X3 Syracuse Persistent XSS in Edit User page
Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version …
-
Medium 5.5
Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
-
Critical 10.0
Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing
Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, …
-
Medium 5.3
Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor
Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full R…
-
Unscored —CVE-2021-33032 EPSS 52%
A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and includ…
-
Unscored —
SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php.
-
Unscored —CVE-2021-36222 EPSS 11%
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1…
-
Unscored —
Cross-site scripting (XSS) vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to i…
-
Unscored —
Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unsp…
-
Unscored —
Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified ve…
-
Unscored —
SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbit…
-
Critical 9.8
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…
KEV Nov 3, 2021 -
Unscored —
Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbi…
-
Unscored —
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execut…
-
Unscored —
Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion."
-
High 7.9
Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote …
-
High 7.8
Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Hom…
-
Unscored —
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proxi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attack…