Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
80 results · Clear filters · Feed
-
Critical 9.8
IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an …
-
Critical 9.6
Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerabilit…
-
Critical 9.8
NukeViet SQL Injection vulnerability
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
-
Critical 9.8
NukeViet SQL Injection vulnerability via topicsid parameter
SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
-
Critical 9.8CVE-2020-36239 EPSS 50%
Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before …
-
Critical 9.8
Remote code execution via RMI
Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocat…
-
Critical 9.8
Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.…
-
Critical 9.8
Code injection in topthink/think
A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
-
Critical 10.0
Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing
Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, …
-
Critical 9.8
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…
KEV Nov 3, 2021 -
Critical 9.1
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (i…
-
Critical 9.8
Unauthenticated attacker could gain access to currently open files
Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exp…
-
Critical 9.8
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Sup…
-
Critical 9.8
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…
-
Critical 9.9
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported v…
-
Critical 9.6
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported v…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versio…
-
Critical 9.1
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…
-
Critical 9.8
Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential …
-
Critical 9.1
Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A r…
-
Critical 9.0
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to …
-
Critical 9.8
Learningdigital.com, Inc. Orca HCM - Hard-code password
The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in.
-
Critical 9.8
Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type
The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks.
-
Critical 9.9
Windows Kernel Remote Code Execution Vulnerability
Windows Kernel Remote Code Execution Vulnerability
-
Critical 9.8
TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Use of Hard-coded Credentials
Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission.
-
Critical 9.6
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applicatio…
-
Critical 9.6
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applicatio…
-
Critical 9.6CVE-2021-21801 EPSS 59%
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applicatio…
-
Critical 9.6CVE-2021-21800 EPSS 14%
Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.…
-
Critical 9.6CVE-2021-21799 EPSS 12%
Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (…
-
Critical 9.1
A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specia…
-
Critical 10.0
A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A s…
-
Critical 9.8
Steel-Belted Radius Carrier Edition: Remote code execution vulnerability when EAP Authentication is configured.
A stack-based Buffer Overflow vulnerability in Juniper Networks SBR Carrier with EAP (Extensible Authentication Protocol) authentication configured, allows an attacker sending specific packets causing the radius daemon to crash resulting with a Denial of Serv…
-
Critical 9.9
Rancher: Cloud credentials can be used through proxy API by users without access
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue…
-
Critical 9.0
Serv-U Remote Memory Escape Vulnerability
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…
KEV Nov 3, 2021 -
Critical 9.8
SQL Injection in Subrion CMS
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
-
Critical 9.0
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021