Archive
13 August 2021
Vulnerabilities first published on this day (UTC), newest first.
64 results · Feed
-
High 7.8
A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs…
-
High 7.8
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the comma…
-
High 7.8
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the comma…
-
High 7.8
A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs…
-
Unscored —
An issue was discovered in Bento4 v1.5.1.0. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Ato…
-
Critical 10.0
Improper Authorization and Origin Validation Error in OneFuzz
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable On…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem func…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ …
-
Medium 4.0
SQL injection in TYPO3 extension
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
-
Unscored —
The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-i…
-
High 7.5
Improper Resource Shutdown or Release in TYPO3 extension
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
-
Medium 6.8
CSRF token exposure in TYPO3 extension
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
-
Medium —
Cross-site Scripting in the femanager TYPO3 extension
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
-
High 7.5
Sensitive Data Exposure in miniorange_saml
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
-
High 8.5
Cross-site Scripting in TYPO3 extension
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
-
Medium 5.4
Cross-site Scripting in the yoast_seo TYPO3 extension
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
-
Unscored —
An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC110…
-
Unscored —
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to execute arbitrary code.
-
Unscored —
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (…
-
Unscored —
An arbitrary memory access vulnerability in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100 allo…
-
Unscored —
An information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC MAC1100.
-
Unscored —
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escala…
-
Unscored —
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various a…
-
Unscored —
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registra…
-
Unscored —
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.
-
Unscored —
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.
-
Critical 9.8
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dn…
KEV Mar 5, 2024 -
Unscored —
There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is…
-
Medium 5.3
IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disc…
-
Critical 9.8
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
-
Medium 5.3
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
-
High 7.8
NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared …
-
Unscored —
The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) regi…
-
Unscored —
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to imp…
-
Unscored —
The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Adm…
-
Unscored —
The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.…
-
Unscored —
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code informati…
-
Unscored —
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due …
-
Unscored —
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking at…
-
Unscored —
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In…