Archive
13 August 2021
Vulnerabilities first published on this day (UTC), newest first.
64 results · Feed
-
Unscored —
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system inf…
-
Unscored —
The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modif…
-
High 7.5
XML External Entity Reference
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
-
Unscored —
The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) u…
-
Medium 4.3
Information exposure in Discourse
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed.
-
Medium 5.3
Re-use of email tokens in Discourse
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification …
-
Unscored —CVE-2021-38619 Public exploit
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can condu…
-
Unscored —
The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-3…
-
Unscored —CVE-2021-38583 Public exploit
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting …
-
Unscored —
A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_A…
-
Unscored —
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"
-
Medium 4.6
On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack.
-
Unscored —
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post a…
-
Unscored —CVE-2021-37344 EPSS 97%
Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of …
-
Unscored —
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from th…
-
Unscored —CVE-2021-37346 EPSS 74%
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation…
-
Unscored —
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the …
-
Unscored —
Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index…
-
Unscored —
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input …
-
Unscored —CVE-2021-37350 EPSS 79%
Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper …
-
Unscored —
Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded…
-
Unscored —
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vul…
-
Unscored —
Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.
-
Unscored —
A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls i…