Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
344 results · Clear filters · Feed
-
Medium 5.8
Cisco Nexus 9500 Series Switches Access Control List Bypass Vulnerability
A vulnerability in the EtherChannel port subscription logic of Cisco Nexus 9500 Series Switches could allow an unauthenticated, remote attacker to bypass access control list (ACL) rules that are configured on an affected device. This vulnerability is due to o…
-
Medium 5.3
Cisco NX-OS Software system login block-for Denial of Service Vulnerability
A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service (DoS) condition. This vulnerabil…
-
Medium 6.0
Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation Vulnerability
A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during…
-
Medium 4.4
Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read Vulnerability
A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected system. Thi…
-
Medium 5.4
Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability
A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to im…
-
Medium 6.5
Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more inform…
-
Medium 6.5
Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more inform…
-
Medium 5.5
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client app…
-
Medium 6.6
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impers…
-
Medium 5.0
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL …
-
Medium 4.3
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/C…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentr…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation…
-
Medium 4.3
Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 …
-
Medium 6.5
An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remot…
-
Medium 5.9
A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remo…
-
Medium 6.8
A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote …
-
Medium 5.8
Excessive CPU utilization when closing HTTP/2 streams
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of…
-
Medium 6.1
Adobe Creative Cloud Installer Arbitrary File Write
Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Insecure temporary file creation vulnerability. An attacker could leverage this vulnerability to cause arbitrary file overwriting in the context of the current us…
-
Medium 5.5
Adobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosure
Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the c…
-
Medium 5.5
Adobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosure
Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the c…
-
Medium 5.5
Adobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosure
Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the c…
-
Medium 6.1
Adobe After Effects Out-of-bounds Read vulnerability
Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial …
-
Medium 6.1
Adobe After Effects Out-of-bounds Read vulnerability
Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial …
-
Medium 5.5
Adobe After Effects Out-of-bounds Read vulnerability could lead to sensitive information disclosure
Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of t…
-
Medium 6.1
Adobe After Effects Out-of-bounds Read vulnerability
Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial …
-
Medium 6.1
Adobe After Effects Out-of-bounds Read vulnerability
Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial …
-
Medium 5.5
Adobe After Effects Out-of-bounds Read vulnerability could lead to sensitive information disclosure
Adobe After Effects version 18.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of t…
-
Medium 5.5
Adobe After Effects Out-of-bounds Read vulnerability could lead to sensitive information disclosure
Adobe After Effects version 18.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of t…
-
Medium 5.4
Adobe Experience Manager Server-side Request Forgery could lead to Security feature bypass
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of th…
-
Medium 6.3
Adobe Experience Manager Cross-site Scripting vulnerability in inbox render.jsp
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScrip…
-
Medium 6.3
Adobe Experience Manager Cross-site Scripting vulnerability in inbox workitem.jsp
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScrip…
-
Medium 6.5
Consensus flaw during block processing in go-ethereum
go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the v…
-
Medium 5.4
Prototype Pollution
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
-
Medium 6.5
Denial of Service (DoS)
All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
-
Medium 5.4
Cross-site Request Forgery (CSRF)
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
-
Medium 4.3
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a us…
-
Medium 5.3
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized us…
-
Medium —
CKEditor 4 vulnerabilities in versions <4.16.1
Details see: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 ) https://github.com/ckeditor/ckeditor4/security/advis…
-
Medium —
Argo Server TLS requests could be forged by attacker with network access
### Impact We are not aware of any exploits. This is a pro-active fix. Impacted: * You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless). * The attacker is with…