Archive
26 July 2021
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Unscored —
tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead t…
-
Unscored —
tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead t…
-
Unscored —
arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to …
-
Unscored —
TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-167…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
-
Unscored —
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
-
Critical 9.8
Code injection in topthink/think
A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.
-
Medium 6.5
Denial of Service via Steam chat in ArchiSteamFarm
ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through …
-
Medium 4.8
Cross Site Scripting in LavaLite CMS
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
-
Medium 6.8
Accidental removal of IPCPassword (< 5.1.2.4)
ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` ASF API endpoint responsible for updating global ASF config incorrectly removed `IPCPassword` from th…
-
Unscored —
A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges.
-
Unscored —
A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.
-
Unscored —
A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate p…
-
Unscored —
TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed c…
-
Unscored —
An issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows attackers to escalate…
-
Unscored —
A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate…
-
Unscored —CVE-2021-36563 Public exploit
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the …
-
Unscored —
In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, whi…
-
Unscored —
In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `childr…
-
Unscored —
In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `id` thro…
-
Unscored —
In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `templa…
-
Unscored —
In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products…
-
Unscored —
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user re…
-
Unscored —
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can…
-
Unscored —
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API…
-
Medium 4.9
Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCo…
-
Unscored —CVE-2021-25804 Public exploit
A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the …
-
Unscored —
A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows at…
-
Unscored —
A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attacke…
-
Unscored —CVE-2021-25801 Public exploit
A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to c…
-
High 7.5
Arbitrary SQL (SQL injection) possible via the Store API component.
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a care…
-
Medium 6.5
JSON Web Tokens not properly verified
Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able …
-
Unscored —
isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing ext…
-
Unscored —
app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.
-
Unscored —
DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing l…
-
Medium 4.3
IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed te…