Archive
17 August 2021
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
Unscored —
In flv extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Unscored —
In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Unscored —
In asf extractor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Medium 5.5
In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifier…
-
Medium 5.5
In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permi…
-
Unscored —
In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcas…
-
Unscored —
In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiv…
-
Medium 5.5
In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. This c…
-
Unscored —CVE-2021-0519 Public exploit
In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. This c…
-
Unscored —
In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to loca…
-
Unscored —
In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation. This co…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin…
-
Low 3.9
Command injection in @diez/generation
The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contain…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php.
-
Unscored —
An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline co…
-
Unscored —
In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session bet…
-
High 7.3
A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow…
-
High 7.2
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a spe…
-
Critical 9.4
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view devic…
-
Medium 6.6
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file …
-
Medium 6.8
A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow priv…
-
Medium 6.1
The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter setti…
-
Critical 9.6
Post-authentication Remote Code Execution (RCE) in ZStack REST API
ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Executi…
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious…
-
Medium 4.7
Improper User Access Control in "Dolibarr" Leads to Account Takeover
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover o…
-
High 8.8
Account Takeover in "Dolibarr" via Password Reset Functionality
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email whe…
-
Medium 4.3
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an a…
-
Medium 5.4
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input…