Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
344 results · Clear filters · Feed
-
Medium 5.5
Floating point exception in `SparseDenseCwiseDiv` in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc5…
-
Medium 4.6
Arbitrary HTML injection vulnerability in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using …
-
Medium 5.9
Cross site scripting via HTML attributes in the back end
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
-
Medium 6.9
Open Redirect in Next.js versions below 11.1.0
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In gene…
-
Medium 4.4
NVIDIA Linux kernel distributions contain a vulnerability in the kernel crypto node, where use after free may lead to c…
-
Medium 4.7
NVIDIA camera firmware contains a difficult to exploit vulnerability where a highly privileged attacker can cause unaut…
-
Medium 5.5
NVIDIA Linux kernel distributions contain a vulnerability in nvmap, where a null pointer dereference may lead to comple…
-
Medium 6.7
Bootloader contains a vulnerability in the NV3P server where any user with physical access through USB can trigger an i…
-
Medium 5.6
Prototype Pollution
All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
-
Medium 5.9
PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage
Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and confi…
-
Medium 4.2
PAN-OS: Weak Cryptography Used in Web Interface Authentication
A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long du…
-
Medium 6.8
PAN-OS: Improper SAML Authentication Vulnerability in GlobalProtect Portal
An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user in the GlobalProtect Portal and GlobalProtect Gateway when they are configured to use SAML authentic…
-
Medium 4.9
PAN-OS: OS Command Argument Injection in Web Interface
An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.…
-
Medium 5.3
IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force…
-
Medium 4.3
IBM Security Guardium 11.2 could disclose sensitive information due to reliance on untrusted inputs that could aid in f…
-
Medium 4.7
IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier f…
-
Medium 6.1CVE-2021-34640 Scanner template
Securimage-WP-Fixed <= 3.5.4 Reflected Cross-Site Scripting
The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.
-
Medium 6.9
Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70, RAX75 befor…
-
Medium 6.3
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6250 before 1.0.4.36,…
-
Medium 6.6
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52,…
-
Medium 6.1
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50,…
-
Medium 6.8
NETGEAR R6400 devices before 1.0.1.52 are affected by a stack-based buffer overflow by an authenticated user.
-
Medium 6.9
NETGEAR R6400 devices before 1.0.1.70 are affected by a stack-based buffer overflow by an authenticated user.
-
Medium 4.5
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects MK62 befor…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 befo…
-
Medium 4.3
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX35 before 1.0…
-
Medium 4.7
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.…
-
Medium 6.8
NETGEAR WAC104 devices before 1.0.4.15 are affected by incorrect configuration of security settings.
-
Medium 5.4
NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS.
-
Medium 4.1
Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6100 be…
-
Medium 4.3
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 b…
-
Medium 4.3
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 b…
-
Medium 4.2
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 b…
-
Medium 6.3
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 be…
-
Medium 6.3
Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.…
-
Medium 6.5
Dell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized …
-
Medium 6.1
Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to…
-
Medium 4.3
Due to improper input validation in InfraBox, logs can be modified by an authenticated user.
-
Medium 6.1
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing…
-
Medium 4.3
Improper Access Control in “Dolibarr”
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/…