Archive
4 August 2021
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Medium 6.3
EspoCRM Avatar Persistent XSS
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.
-
Medium 5.2
Akaunting Invoice Footer Persistent XSS
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product.
-
Medium 5.4
Akaunting Password Reset Relay
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in …
-
Medium 6.3
Akaunting Avatar Persistent XSS
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product.
-
Medium 6.5
Akaunting DoS via User-Controlled 'locale' Variable
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product.
-
High 8.1
Akaunting Authentication Bypass in Company Selection
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.
-
High 8.7
Akaunting OS Command Injection in 'Money.php'
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function is executed directly…
-
Medium 6.5
Pimcore AdminBundle 'specificID' SQL Injection
Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product.
-
Medium 6.5
Pimcore Customer Data Framework 'SegmentAssignmentController.php' Blind SQL Injection
Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product.
-
Unscored —
libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-20…
-
Unscored —
An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overf…
-
Unscored —
The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer der…
-
Critical 9.8
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Acc…
KEV Mar 28, 2022 -
Unscored —
In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add B…
-
Unscored —
An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1…
-
Unscored —
An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service an…
-
High 7.5
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 throu…
-
Medium 5.4
Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox befor…
-
Medium 6.4
Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authent…
-
Medium 5.7
Stored XSS Vulnerability in the Pi-hole Webinterface
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scri…
-
High 7.6
(Authenticated) Remote Code Execution Possible in Web Interface 5.5
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used…
-
Medium 6.5
Cisco Evolved Programmable Network Manager Sensitive Information Disclosure Vulnerability
A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect …
-
Critical 9.8
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an attacker to do the following: Execute arbitrary code Cause a denial of service (DoS) condit…
-
Critical 9.8
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an attacker to do the following: Execute arbitrary code Cause a denial of service (DoS) condit…
-
High 8.2
Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected …
-
High 7.3
Cisco Packet Tracer for Windows DLL Injection Vulnerability
A vulnerability in Cisco Packet Tracer for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulner…
-
Medium 4.3
Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass
A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on…
-
High 7.8
ConfD CLI Secure Shell Server Privilege Escalation Vulnerability
A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root. To exploit this vulnerability, an attacker must have a valid account on an af…
-
High 8.8
An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2,…
-
Medium 6.0
A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 thro…
-
High 8.8
Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 thro…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8CVE-2021-34850 EPSS 38%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8CVE-2021-34847 EPSS 62%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0…