Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
31 results · Clear filters · Feed
-
Low 3.2
clone-master-clean-up: dangerous file system operations
A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary fil…
-
Low 3.1
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authori…
-
Low 3.5
A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize …
-
Low 3.5
Unautorized access to the calendar appointments
Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
-
Low 3.5
Unautorized listing of the customer user emails
Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.
-
Low 3.1
XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vul…
-
Low 3.7
Vulnerability in the Oracle Financial Services Crime and Compliance Investigation Hub product of Oracle Financial Servi…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Jav…
-
Low 3.7
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: JS module). Supported versions that are…
-
Low 3.9
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Low 3.1
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supp…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are a…
-
Low 3.5
Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported…
-
Low 3.5
Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported…
-
Low 3.5
Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported…
-
Low 2.7
Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.…
-
Low 2.7
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed …
-
Low 2.7
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed …
-
Low 2.7
IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input valida…
-
Low 3.5
When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator ap…
-
Low 3.1
File path disclosure of shared files in Nextcloud Text application
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full pat…
-
Low 3.5
Default share permissions not respected for federated reshares
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.…
-
Low 3.3
Audit log is not properly logging unsetting of share expiration date
Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is suppo…
-
Low 2.6
Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-…
-
Low 3.5
Filenames not escaped by default in controllers using DownloadResponse
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-supplied filename was passed unsanitized into a `…
-
Low 3.7
Ratelimit not applied on OCS API responses
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` anno…
-
Low 3.1
Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP p…
-
Low 3.7
IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, c…
-
Low 3.5
A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject acces…
-
Low 3.5
HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE
-
Low 2.0
A user without PR can reset user authentication failures information
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be …