Archive
22 July 2021
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
Medium 6.5
Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection
By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
-
Medium 6.5
Ivanti MobileIron Core clish Restricted Shell Escape via OS Command Injection
By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
-
Medium 4.6
Sage X3 Syracuse Persistent XSS in Edit User page
Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version …
-
Medium 5.5
Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
-
Medium 5.3
Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor
Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full R…
-
Medium 5.4
Cisco Unified Customer Voice Portal Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack against a user. This vulnerability is due to insufficient input val…
-
Medium 6.3
Cisco Firepower Device Manager On-Box Software Remote Code Execution Vulnerability
A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient…
-
Medium 5.3
Cisco SD-WAN Software Information Disclosure Vulnerability
A vulnerability in the Multiprotocol Label Switching (MPLS) packet handling function of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to gain access to information stored in MPLS buffer memory. This vulnerability is due to insufficient…
-
Medium 6.5
Cisco Intersight Virtual Appliance Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to …
-
Medium 6.5
Cisco Intersight Virtual Appliance Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to …
-
Medium 5.5
Cisco SD-WAN vManage Software Information Disclosure Vulnerability
A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying file system of an affected system. This vulnerability exists because access to sensitive information o…
-
Medium 5.5
NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) h…
-
Medium 5.5
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handle…
-
Medium 6.2
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an asser…
-
Medium 6.1
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handle…
-
Medium 4.7
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` do…
-
Medium 5.3
Format string bug in the Redis cache implementation
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured …