Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
1,584 results · Feed
-
Medium 6.8
De-anonymization via message
MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a messag…
-
Medium 5.3
Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticat…
-
High 8.1
Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated…
-
High 8.8
Passwords used to access external services inadvertently exposed through API
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 featur…
-
Medium 6.5
IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery…
-
High 7.5
IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow …
-
High 7.5
IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear tex…
-
Unscored —
A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c
-
Unscored —
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_poin…
-
Unscored —
DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678.
-
Unscored —
Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNE…
-
Unscored —
DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment…
-
Unscored —
MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors.
-
Unscored —
MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery.
-
Unscored —
The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, wh…
-
High 8.8
Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation fo…
-
Unscored —
Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service…
-
Unscored —
Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder pe…
-
Unscored —
Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
-
Unscored —CVE-2021-34558 Public exploit
Panic on certain certificates in crypto/tls
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
-
Unscored —
iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemoteP…
-
Unscored —
iDrive RemotePC before 4.0.1 on Linux allows denial of service. A remote and unauthenticated attacker can disconnect a …
-
Unscored —
iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. A remote and unauthenticated attacker can bypass…
-
Unscored —
iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read the s…
-
Unscored —
iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an en…
-
Unscored —
iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A man in the middle can recover a system's Pers…
-
Unscored —
A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters argume…
-
High 8.8
Rancher: Privilege escalation vulnerability via malicious Connection header
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.…
-
Critical 9.9
Rancher: Cloud credentials can be used through proxy API by users without access
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue…
-
High 8.8
rancher: API group not properly specified when creating Kubernetes RBAC resources
A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.
-
Unscored —CVE-2020-25736 Public exploit
Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XP…
-
Unscored —
Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a ma…
-
Unscored —
A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows at…
-
Critical 9.0
Serv-U Remote Memory Escape Vulnerability
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…
KEV Nov 3, 2021 -
Unscored —
Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server
A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files…
-
Unscored —
An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system…
-
Critical 9.8
SQL Injection in Subrion CMS
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
-
Unscored —
A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. Any wireless router using BCM4352 and BCM43684 will be a…
-
Unscored —
An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malfor…
-
Medium 6.5
ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.