Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
358 results · Clear filters · Feed
-
Medium 5.4
Certificate pinning is not enforced on the web socket connection
Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users run…
-
Medium 6.1
LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView.
-
Medium 4.3
IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed techni…
-
Medium 5.9
IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to d…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.9
IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to d…
-
Medium 6.7CVE-2021-1931 Public exploit
Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon …
-
Medium 4.6
Possible buffer over-read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon…
-
Medium 4.6
Possible buffer over read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon…
-
Medium 4.6
Possible buffer over-read due to incorrect overflow check when loading splash image in Snapdragon Consumer IOT, Snapdra…
-
Medium 4.6
Possible Buffer Over-read due to lack of validation of boundary checks when loading splash image in Snapdragon Consumer…
-
Medium 4.3
Weak configuration in WLAN could cause forwarding of unencrypted packets from one client to another in Snapdragon Compu…
-
Medium 5.3
Improper Restriction of XML External Entity Reference in de.tud.sse
FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. I…
-
Medium 5.3
Custom variable protection and blacklists can be circumvented
Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and val…
-
Medium 5.3
Possible path traversal by use of the `doc` module
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator …
-
Medium 5.3
Lack of ratelimit on public share link mount endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid sha…
-
Medium 4.8
XSS in Nextcloud Text application
Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/htm…
-
Medium 5.7
End-to-end encryption device setup did not verify public key
Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that invo…
-
Medium 4.3
Bypass of image blocking in Nextcloud Mail
Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute…
-
Medium 5.4
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar…
-
Medium 6.4
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to e…
-
Medium 6.4
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to e…
-
Medium 6.4
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to e…
-
Medium 5.9
IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enables weaker than exp…
-
Medium 4.7
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and…
-
Medium 4.4
IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly …
-
Medium 4.3
IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malic…
-
Medium 6.4
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerabil…
-
Medium 6.4
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerabil…
-
Medium 5.7
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 do not exit on failed Initialization. A local au…
-
Medium 6.5
Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An …
-
Medium 5.3
Lack of ratelimit on public DAV endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or …
-
Medium 5.3
Lack of ratelimit on shareinfo endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The…
-
Medium 5.3CVE-2021-33037 EPSS 75%
Incorrect Transfer-Encoding handling with HTTP/1.0
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - T…