Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
358 results · Clear filters · Feed
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 4.3
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…
-
Medium 5.2
Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). T…
-
Medium 5.4
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…
-
Medium 5.4
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…
-
Medium 4.3
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supp…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 6.1
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Sup…
-
Medium 4.9
Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0…
-
Medium 4.3
Vulnerability in the Core RDBMS component of Oracle Database Server. The supported version that is affected is 19c. Eas…
-
Medium 4.6
Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Lo…
-
Medium 5.9
Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Fl…
-
Medium 5.5
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Va…
-
Medium 4.0
IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self serv…
-
Medium 4.3
Regular Expression Denial of Service in OpenProject forum messages
OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex …
-
Medium 5.3
Information Disclosure in User Authentication
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is n…
-
Medium 6.4
Cross-Site Scripting in Backend Grid View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corr…
-
Medium 6.4
Cross-Site Scripting in Query Generator & Query View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGen…
-
Medium 6.4
Cross-Site Scripting in Page Preview
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding …
-
Medium 6.7
A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5…
-
Medium 6.3
An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow…
-
Medium 5.3
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and fro…
-
Medium 6.1
Cross-Site Request Forgery (CSRF) in DataDump
DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in…
-
Medium 5.5
Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact…
-
Medium 4.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Support…
-
Medium 6.1
Confused deputy attack in sandbox module resolution
Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their inte…
-
Medium 5.4
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to …
-
Medium 4.1
Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated at…
-
Medium 6.4
Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X envir…
-
Medium 4.7
IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should n…
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows user…
-
Medium 5.4
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows user…
-
Medium 6.1
Cross-site Scripting in OWASP AntiSamy
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
-
Medium 5.5
Denial of Service in SheetsJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
-
Medium 4.3
Learningdigital.com, Inc. Orca HCM - Path Traversal-2
The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.
-
Medium 5.3
Learningdigital.com, Inc. Orca HCM - Path Traversal-1
The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in.
-
Medium 6.1
Learningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')
The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks.