Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corr…
KEV Nov 3, 2021 -
Unscored —
Use after free in WebSerial in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit he…
-
Unscored —
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corr…
-
Unscored —
Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit h…
-
Unscored —
Use after free in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corr…
-
Medium 4.3
Liferay Portal and Liferay DXP Don't Check Permissions of Pages
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page…
-
High 7.5
Liferay Portal and Liferay DXP autosaves form data for other users to see
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing th…
-
Unscored —
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <…
-
High 7.5
Liferay Portal and Liferay DXP insecure default configuration
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be default…
-
Unscored —
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0…
-
Medium 4.3
Liferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rate
The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users …
-
Unscored —
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allow…
-
Unscored —
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scri…
-
Unscored —
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage…
-
Unscored —
In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. The vul…
-
High 8.5
An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due t…
-
Critical 9.9
An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the writing of arbitrary files to…
-
Unscored —
Arbitrary File Upload in Sourcecodester Phone Shop Sales Management System 1.0 enables RCE.
-
Unscored —CVE-2021-36654 Public exploit
CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) whil…
-
Unscored —
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin…
-
Unscored —
An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus a…
-
Unscored —
A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. Local attackers may exploit this vulnerability to…
-
Unscored —
A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers m…
-
Unscored —
A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulne…
-
Unscored —
A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may ex…
-
Unscored —
A component of the HarmonyOS has a Double Free vulnerability. Local attackers may exploit this vulnerability to cause R…
-
Unscored —
A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability…
-
Unscored —
A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulner…
-
Unscored —
A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. Local attackers may exploit this vulnerability …
-
Unscored —
A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability…
-
Unscored —
A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulne…
-
Unscored —
Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs allow a threat actor to execute arbitrary code from a USB dri…
-
High 7.5
Improperly Controlled Modification of Object Prototype Attributes
### Impact The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. ### Patches `think-config@1.1…
-
High 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Skytable
Skytable is a NoSQL database with automated snapshots and TLS. Versions prior to 0.5.1 are vulnerable to a a directory traversal attack enabling remotely connected clients to destroy and/or manipulate critical files on the host's file system. This security bu…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
Critical 9.9
An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the…
-
Unscored —
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Imp…
-
Unscored —
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
-
Critical 9.8
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.