Archive
3 August 2021
Vulnerabilities first published on this day (UTC), newest first.
112 results · Feed
-
Unscored —
Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs allow a threat actor to execute arbitrary code from a USB dri…
-
High 7.5
Improperly Controlled Modification of Object Prototype Attributes
### Impact The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. ### Patches `think-config@1.1…
-
High 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Skytable
Skytable is a NoSQL database with automated snapshots and TLS. Versions prior to 0.5.1 are vulnerable to a a directory traversal attack enabling remotely connected clients to destroy and/or manipulate critical files on the host's file system. This security bu…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
Critical 9.9
An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the…
-
Unscored —
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Imp…
-
Unscored —
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
-
Critical 9.8
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
-
Unscored —
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote una…
-
Unscored —CVE-2021-37557 EPSS 27%
A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authe…
-
Unscored —CVE-2021-37556 EPSS 27%
A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authe…
-
Medium 6.5
Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could pote…
-
Medium 4.3
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing …
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker …
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker …
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker …
-
Medium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker …
-
Unscored —
Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Co…
-
Unscored —
A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Co…
-
Unscored —
Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain acce…
-
Unscored —
A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function…
-
High 8.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entries
Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast informat…
-
Medium 5.3
Path traversal in Grafana Loki
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt…
-
Medium —
Path traversal in Grafana Cortex
An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will att…
-
Unscored —
libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and …
-
Unscored —
Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation. An …
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid appli…
-
Unscored —CVE-2021-37832 Public exploit
A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application datab…
-
Unscored —CVE-2021-35265 Scanner template
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attack…
-
Medium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…
KEV Mar 28, 2022 -
High 8.8CVE-2021-30560 EPSS 20%
Nokogiri has vulnerable dependencies on libxml2 and libxslt
Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.