Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
Unscored —
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS hands…
-
Unscored —CVE-2021-34228 EPSS 29%
Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allow…
-
Unscored —
Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows att…
-
Unscored —
Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows a…
-
Unscored —
Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /a…
-
Unscored —
Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows atta…
-
Unscored —
Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attacker…
-
Critical 9.8
SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
-
Unscored —
Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/u…
-
Unscored —
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the…
-
Unscored —
Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious file…
-
Unscored —
Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.p…
-
Unscored —
SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in t…
-
Low 3.3
A heap-based buffer overflow in the libexe_io_handle_read_coff_optional_header function of libyal libexe before 2018112…
-
Unscored —
A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of s…
-
Unscored —
An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows at…
-
Unscored —
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
-
Unscored —CVE-2021-37598 Scanner template
WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.
-
High 8.8
Cross-Site Request Forgery in OWASP CSRFGuard
In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code…
-
Unscored —
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
-
Unscored —
Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mat…
-
Unscored —
In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow
-
High 8.8
Shopping Cart & eCommerce Store <= 5.1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, …
-
Medium 4.3
Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability
Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This issue was resolved in version 6.6.96, released on August…
-
Unscored —
A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System…
-
High 7.5
Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do…
-
Unscored —
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which …
-
Unscored —
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows rem…
-
Unscored —
A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Projec…
-
Unscored —
A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System …
-
Unscored —CVE-2021-39273 Public exploit
In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an …
-
Unscored —
In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing …
-
Unscored —
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn'…
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connecti…
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP …
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP…
-
Unscored —
An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processin…
-
Unscored —
The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite lo…