Archive
18 August 2021
Vulnerabilities first published on this day (UTC), newest first.
99 results · Feed
-
Medium 5.8
An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and belo…
-
Unscored —
Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle…
-
Medium 4.8
New anonymous user session acts as if it's created with password
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed u…
-
Critical 9.8
A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4…
-
High 8.8
OS Command Injection in Centreon
/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.
-
High 7.8
AppDynamics .NET Agent Privilege Escalation Vulnerability
A vulnerability in the AppDynamics .NET Agent for Windows could allow an attacker to leverage an authenticated, local user account to gain SYSTEM privileges. This vulnerability is due to the .NET Agent Coordinator Service executing code with SYSTEM privileges…
-
Medium 5.8
Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability
A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on…
-
Medium 6.5
Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Double-Free Denial of Service Vulnerability
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is d…
-
Critical 9.8
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability
A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resu…
-
Medium 6.7
Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root use…
-
Medium 4.7
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating syste…
-
Medium 5.4
Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of anot…
-
Unscored —
In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.
-
Unscored —
The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary…
-
Unscored —
An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does …
-
Unscored —
The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of se…
-
Unscored —
The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. Th…
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=…
-
High 7.5
A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use
In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerabili…
-
Unscored —
A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticat…
-
Unscored —
A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitiv…
-
Unscored —
A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.
-
Medium 6.1
Cross-site scripting in pywb
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
-
High 7.3
Untrusted Search Path in Nextcloud Desktop Client
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3…
-
Unscored —
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
-
Unscored —
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP …
-
Unscored —
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client c…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
-
Unscored —
Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a ma…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
-
Medium 6.5
End-to-end encryption device setup did not verify public key
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Des…
-
High 7.5
Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to ge…
-
High 8.0
Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.
-
Unscored —
In OMA DRM, there is a possible memory corruption due to improper input validation. This could lead to local escalation…
-
Unscored —
In OMA DRM, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of pr…
-
Unscored —
In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Unscored —
In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local d…
-
Unscored —
In memory management driver, there is a possible system crash due to improper input validation. This could lead to loca…
-
Unscored —
In memory management driver, there is a possible system crash due to improper input validation. This could lead to loca…