Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
1,584 results · Feed
-
High 7.5
Possible buffer over read due to improper validation of data pointer while parsing FILS indication IE in Snapdragon Aut…
-
High 7.5
Improper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 f…
-
High 7.5
Possible out of bound read due to lack of length check of Bandwidth-NSS IE in Snapdragon Auto, Snapdragon Compute, Snap…
-
High 7.5
Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beaco…
-
High 7.5
Possible assertion due to improper verification while creating and deleting the peer in Snapdragon Auto, Snapdragon Com…
-
Medium 6.7CVE-2021-1931 Public exploit
Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon …
-
High 7.5
Possible buffer overflow due to lack of length check in BA request in Snapdragon Auto, Snapdragon Compute, Snapdragon C…
-
Medium 4.6
Possible buffer over-read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon…
-
Medium 4.6
Possible buffer over read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon…
-
Medium 4.6
Possible buffer over-read due to incorrect overflow check when loading splash image in Snapdragon Consumer IOT, Snapdra…
-
Medium 4.6
Possible Buffer Over-read due to lack of validation of boundary checks when loading splash image in Snapdragon Consumer…
-
Medium 4.3
Weak configuration in WLAN could cause forwarding of unencrypted packets from one client to another in Snapdragon Compu…
-
High 8.4
Improper length check of public exponent in RSA import key function could cause memory corruption. in Snapdragon Auto, …
-
High 8.4
Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Sna…
-
High 8.4
Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto,…
-
High 7.5
An assertion can be reached in the WLAN subsystem while using the Wi-Fi Fine Timing Measurement protocol in Snapdragon …
-
High 8.4
Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon …
-
Critical 9.8
Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Comput…
-
Unscored —
A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS…
-
Critical 9.8
Buffer Overflow in Pillow
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
-
High 8.4
Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Sna…
-
Unscored —
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…
-
Medium 5.3
Improper Restriction of XML External Entity Reference in de.tud.sse
FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. I…
-
Medium 5.3
Custom variable protection and blacklists can be circumvented
Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and val…
-
Medium 5.3
Possible path traversal by use of the `doc` module
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator …
-
Medium 5.3
Lack of ratelimit on public share link mount endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid sha…
-
Low 3.1
File path disclosure of shared files in Nextcloud Text application
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full pat…
-
Medium 4.8
XSS in Nextcloud Text application
Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/htm…
-
Medium 5.7
End-to-end encryption device setup did not verify public key
Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that invo…
-
High 7.1
Webauthn tokens not removed after user has been deleted
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain acce…
-
Unscored —
SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the compone…
-
Low 3.5
Default share permissions not respected for federated reshares
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.…
-
Unscored —
YOP Poll < 6.2.8 - Stored Cross-Site Scripting
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitis…
-
Unscored —
Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection
The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL…
-
Unscored —
Sign-up Sheets < 1.0.14 - Authenticated CSV Injection
The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
-
Unscored —
Sign-up Sheets < 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)
The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered …
-
Unscored —
Browser Screenshots < 1.7.6 - Contributor+ Stored XSS
The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.
-
Unscored —
Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)
The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allo…
-
Unscored —
Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting …
-
Unscored —
Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue