Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
1,584 results · Feed
-
Unscored —
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL …
-
Unscored —
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintende…
-
Unscored —
Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an atta…
-
Unscored —
Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project…
-
Critical 9.8
An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versi…
-
Critical 9.8
SQL Injection in Django
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
-
Medium 6.5
Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…
-
Unscored —
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" f…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary we…
-
Medium 5.3
The reset password form reveal users email address
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem h…
-
Medium 5.7
No CSRF protection on the password change form
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, wh…
-
Low 2.0
A user without PR can reset user authentication failures information
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be …
-
Unscored —
An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged use…
-
Unscored —CVE-2020-27361 Scanner template
An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information withi…
-
Medium 5.4
IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability al…
-
Medium 6.3
IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could se…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated …
-
Unscored —
Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated use…
-
Unscored —
An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.
-
High 8.8
Facility Explorer
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sendin…
-
High 8.8
C-CURE 9000
An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.
-
Unscored —
Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any at…
-
Unscored —
Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web …
-
Unscored —
When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plu…
-
Unscored —CVE-2021-31813 EPSS 78%
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details …
-
Unscored —
There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability…
-
Unscored —
There is a Configuration Defect vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may a…
-
Unscored —
There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability m…
-
Unscored —
There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability m…
-
Unscored —
Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access res…
-
Unscored —
Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary sc…
-
Unscored —
UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdEx…
-
Unscored —
UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from…
-
Unscored —
RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable.
-
Unscored —
LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).