Archive
25 August 2021
Vulnerabilities first published on this day (UTC), newest first.
75 results · Feed
-
Unscored —
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a …
-
Medium —
Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
-
Medium —
Unchecked vector pre-allocation
Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of …
-
Medium —
Memory over-allocation in evm-core
Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The…
-
High —
fake-static allows converting any reference into a `'static` reference
fake-static allows converting a reference with any lifetime into a reference with `'static` lifetime without the `unsafe` keyword. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc
-
Unscored —
ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an auth…
-
Unscored —
In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a…
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.
-
Unscored —
Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
-
Medium 4.3
Cisco UCS Manager Software SSH Sessions Denial of Service Vulnerability
A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management for establis…
-
Medium 5.8
Cisco Nexus 9500 Series Switches Access Control List Bypass Vulnerability
A vulnerability in the EtherChannel port subscription logic of Cisco Nexus 9500 Series Switches could allow an unauthenticated, remote attacker to bypass access control list (ACL) rules that are configured on an affected device. This vulnerability is due to o…
-
Medium 5.3
Cisco NX-OS Software system login block-for Denial of Service Vulnerability
A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service (DoS) condition. This vulnerabil…
-
High 8.6
Cisco NX-OS Software MPLS OAM Denial of Service Vulnerability
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to impro…
-
High 8.6
Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service Vulnerability
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerabili…
-
High 8.6
Cisco Nexus 9000 Series Fabric Switches ACI Mode Multi-Pod and Multi-Site TCP Denial of Service Vulnerability
A vulnerability in the Multi-Pod or Multi-Site network configurations for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, remote attacker to unexpectedly restart the device, resulting in…
-
Medium 6.0
Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation Vulnerability
A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during…
-
Medium 4.4
Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read Vulnerability
A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected system. Thi…
-
Medium 5.4
Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability
A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to im…
-
Medium 6.5
Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more inform…
-
Medium 6.5
Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more inform…
-
High 8.1
Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to…
-
High 8.8
Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker to elevate privileges to Administrator on a…
-
Critical 9.1
Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an af…
-
High 8.6
Cisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service Vulnerability
A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause a queue wedge on a leaf switch, which could result in critical control plane traffic to the de…
-
Unscored —
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.…
-
Medium 5.5
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client app…
-
High 8.7CVE-2021-22242 EPSS 64%
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a…
-
Medium 6.6
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impers…
-
Medium 5.0
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL …
-
Low 3.1
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a rep…
-
Medium 4.3
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/C…
-
Low 2.7
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages i…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentr…
-
Unscored —
A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions e…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation…
-
Unscored —
A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NE…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…