Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
1,584 results · Feed
-
Critical 9.8
NukeViet SQL Injection vulnerability
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
-
Critical 9.8
NukeViet SQL Injection vulnerability via topicsid parameter
SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
-
Medium 6.1
NukeViet Cross-site Scripting via the editor in the News module
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.
-
Unscored —
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, …
-
Medium 4.4
The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange…
-
Unscored —
The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attacke…
-
Critical 9.8CVE-2020-36239 EPSS 50%
Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before …
-
Critical 9.8
Remote code execution via RMI
Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocat…
-
High 7.0
Arbitrary Code Execution in Rdoc
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
-
Unscored —
eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.
-
Unscored —
Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision…
-
Unscored —
Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page.
-
Unscored —
This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The admin…
-
High 7.5
Directory Traversal
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
-
Medium 5.6
Prototype Pollution
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
-
Unscored —
Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbi…
-
Unscored —
A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authenticati…
-
Unscored —
A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authenticati…
-
High 7.5
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, m…
-
Medium 5.4
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Medium 6.3
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated atta…
-
Unscored —
Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Co…
-
Low 3.2
clone-master-clean-up: dangerous file system operations
A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary fil…
-
Medium 6.5
K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and…
-
Medium 6.5
Cross-site Scripting (XSS)
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
-
Unscored —
replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp…
-
Unscored —
Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, …
-
Unscored —
Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the versio…
-
Unscored —
Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version…
-
Unscored —
Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the aut…
-
High 7.5
Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges tha…
-
Critical 9.8
Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.…
-
Medium 6.3
Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an…
-
Unscored —
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to us…
-
Unscored —
Telegram Web K Alpha 0.6.1 allows XSS via a document name.
-
Unscored —
In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing …