Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.3…
-
Medium 6.5
A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0…
-
High 8.1
Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.…
-
Medium 4.3
A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker lo…
-
Unscored —
A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service…
-
Unscored —
A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service …
-
Unscored —
A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (…
-
Unscored —
A global buffer overflow issue in the dwarf::line_table::line_table function of Libelfin v0.3 allows attackers to cause…
-
Unscored —
A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) t…
-
Unscored —
A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS…
-
Unscored —
A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service…
-
Medium 5.9
IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service acc…
-
Medium 5.4
IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Unscored —
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a…
-
Critical 9.9
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 throug…
-
Medium 5.4
An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5,…
-
Unscored —
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloa…
-
Medium 6.1
Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.
-
Medium 5.3
An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in posses…
-
Medium 6.1
Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTM…
-
High 7.5
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
-
High 7.5
Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CS…
-
Medium 5.4
Liferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com…
-
Medium 5.3
Missing Cryptographic Step in star7th/showdoc
showdoc is vulnerable to Missing Cryptographic Step
-
Medium 4.8
Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPo…
-
Unscored —
A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticate…
-
Unscored —
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
-
High 8.8
The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (…
-
Unscored —
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a den…
-
Unscored —
A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp du…
-
Unscored —
A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while pars…
-
Medium 4.8
Drop Headers via Malicious Connection Header
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header woul…
-
Unscored —
A security flaw in the 'owned' function of a smart contract implementation for BTC2X (B2X), a tradeable Ethereum ERC20 …
-
Unscored —
A security flaw in the 'owned' function of a smart contract implementation for RobotCoin (RBTC), a tradeable Ethereum E…
-
Unscored —
An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 …
-
Unscored —
An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 tok…
-
Unscored —
An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when…
-
Unscored —
An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a director…
-
Unscored —
An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a…
-
Unscored —
An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webs…