Archive
6 August 2021
Vulnerabilities first published on this day (UTC), newest first.
52 results · Feed
-
Critical —
Jeecg-Boot CMS arbitrary file upload vulnerability
An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.
-
Unscored —
A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sen…
-
Unscored —
A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users.
-
Unscored —
A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers t…
-
Unscored —
An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host wh…
-
Unscored —
A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to ex…
-
Unscored —
LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. …
-
Unscored —CVE-2021-35312 Public exploit
A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Ser…
-
Unscored —
Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain p…
-
Unscored —
Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting maliciou…
-
Unscored —
A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6…
-
Unscored —
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/1…
-
Unscored —
SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\commen…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\…
-
Unscored —
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The l…
-
Unscored —
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. C…
-
Critical 9.8
DreamSecurity MagicLine Buffer Overflow Vulnerability
A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the authorization certificate. An attacker could exploit this vulnerability by sending a crafted HTTP r…
-
Unscored —
Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snap_file paramete…
-
Unscored —
Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, …
-
Unscored —
In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.
-
Unscored —
In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.
-
Unscored —
In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.
-
Unscored —
In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.
-
Unscored —
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.
-
Medium 6.1
Subrion Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
-
Unscored —
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
-
Unscored —
In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.
-
Unscored —
In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.
-
Unscored —
In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.
-
Unscored —
In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.
-
Unscored —
In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.
-
Unscored —
In JetBrains TeamCity before 2020.2.3, XSS was possible.
-
Unscored —
In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.
-
Unscored —
In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
-
Unscored —
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
-
Unscored —
In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset th…
-
Unscored —
In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page paramete…
-
Unscored —
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
-
Unscored —
In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter…
-
Unscored —
In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter v…