Archive
10 August 2021
Vulnerabilities first published on this day (UTC), newest first.
96 results · Feed
-
Unscored —
A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature…
-
Unscored —CVE-2021-37391 Public exploit
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrato…
-
Unscored —
In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because th…
-
Unscored —
In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients ente…
-
Unscored —
Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11…
-
Unscored —
Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11…
-
Unscored —
Null Pointer Deference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B0…
-
Unscored —
Null Pointer Dereference vulnerability in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, an…
-
Unscored —
The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION A…
-
Critical 9.8
Incorrect Authorization in serverless-offline
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (…
-
Unscored —
Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, …
-
Unscored —
Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, …
-
Unscored —
Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2…
-
Unscored —
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer ov…
-
Unscored —
Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the sam…
-
Unscored —
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for th…
-
Unscored —
OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.
-
Medium 6.1
Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to…
-
High 8.1
Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
-
Low 3.8
An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Ell…
-
Unscored —
CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. In bl_categires_he…
-
Unscored —
CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combinin…
-
Unscored —
CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file…
-
Unscored —
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with cra…
-
Unscored —
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories vi…
-
Unscored —
In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Se…
-
Unscored —
In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server a…
-
Medium 4.3
Due to improper input validation in InfraBox, logs can be modified by an authenticated user.
-
High 8.3
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not su…
-
High 8.3
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode …
-
Medium 6.1
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing…
-
High 7.6CVE-2021-33699 Public exploit
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in…
-
Unscored —
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
-
Unscored —
GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check setti…
-
Unscored —
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute ar…
-
Unscored —
UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to s…
-
Unscored —
The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauth…
-
Unscored —
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the abil…
-
Unscored —
Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the p…
-
Low 2.7
IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is re…