Archive
2 August 2021
Vulnerabilities first published on this day (UTC), newest first.
123 results · Feed
-
Medium 5.3
Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. SmartConnect had an error…
-
Medium 6.5
Dell EMC PowerScale OneFS versions 8.1.2-9.1.0.x contain an Improper Check for Unusual or Exceptional Conditions in its…
-
Medium 4.4
Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. This vulnerability allows a user with (ISI_P…
-
High 7.3
Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific condi…
-
Medium 6.1
Joplin vulnerable to Cross-site Scripting in notes
Joplin before 2.0.9 allows XSS via button and form in the note body.
-
Medium —
Workflow re-write vulnerability using input parameter
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
-
Medium 4.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.js
Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send i…
-
Low 3.1
Low risk information disclosure in Sourcegraph
Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed by regular users and all information and features are properly protected except for daily usage stat…
-
High 7.5
Remote Code Execution via Script (Python) objects under Python 3
Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below …
-
Unscored —
Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in…
-
Unscored —
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App:…
-
Unscored —
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App:…
-
Unscored —
The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is v…
-
High 8.8
SEO Backlinks <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1.
-
Medium 6.1
Poll Maker <= 3.2.8 - Reflected Cross-Site Scripting
The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and includin…
-
High 8.8
Admin Custom Login <= 3.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up …
-
High 8.8
Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5.
-
Unscored —
There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the …
-
High 8.8
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality …
-
High 8.8
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of…
-
High 7.8
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionali…
-
Unscored —
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash…
-
Unscored —
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest …
-
Unscored —
A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute…
-
Unscored —
Panic on inputs with large exponents in math/big
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
-
Unscored —
Attacker can drop certain headers in net/http/httputil
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
-
Unscored —
Improper sanitization when resolving values from DNS in net
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
-
Critical 9.8
The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the us…
-
Critical 9.8
Data race in crossbeam-deque
crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of oth…
-
Medium 6.5
URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe…
-
Unscored —
A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can l…
-
Unscored —
There is an Improper Check for Unusual or Exceptional Conditions Vulnerability in Huawei Smartphone.Successful exploita…
-
Unscored —
There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may…
-
Unscored —
There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cau…
-
Medium —
Attack on Kubernetes via Misconfigured Argo Workflows
### Impact Users running using the Argo Server with `--auth-mode=server` (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining. ### Resolution * Do not e…
-
Unscored —
There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cau…
-
Unscored —
There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cau…
-
Unscored —
There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of …
-
Unscored —
There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vu…
-
Unscored —
There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may af…