Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
344 results · Clear filters · Feed
-
Medium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to …
-
Medium 6.5
A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to acces…
-
Medium 4.9
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary a…
-
Medium 6.5
XStream can cause a Denial of Service
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting …
-
Medium 5.6
IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which crea…
-
Medium 5.9
IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen…
-
Medium 5.9
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.6
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful …
-
Medium 5.5
Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An authenticated attacker could leverage this vulnerability achieve an application…
-
Medium 5.5
Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
Medium 6.8CVE-2021-22238 EPSS 72%
An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS…
-
Medium 5.3
An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to …
-
Medium 4.3
Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability
Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This issue was resolved in version 6.6.96, released on August…
-
Medium 6.5
An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to …
-
Medium 5.8
An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and belo…
-
Medium 4.8
New anonymous user session acts as if it's created with password
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed u…
-
Medium 5.8
Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability
A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on…
-
Medium 6.5
Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Double-Free Denial of Service Vulnerability
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is d…
-
Medium 6.7
Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root use…
-
Medium 4.7
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating syste…
-
Medium 5.4
Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of anot…
-
Medium 6.1
Cross-site scripting in pywb
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
-
Medium 6.5
End-to-end encryption device setup did not verify public key
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Des…
-
Medium 4.0
An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management A…
-
Medium 5.4
An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management A…
-
Medium 5.5
In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifier…
-
Medium 5.5
In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permi…
-
Medium 5.5
In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. This c…
-
Medium 6.6
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file …
-
Medium 6.8
A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow priv…
-
Medium 6.1
The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter setti…
-
Medium 4.7
Improper User Access Control in "Dolibarr" Leads to Account Takeover
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover o…
-
Medium 4.3
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an a…
-
Medium 5.4
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input…
-
Medium 6.5
Insecure direct object reference of log files of the Import/Export feature
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.…