Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
High 8.1
Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to…
-
High 8.8
Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker to elevate privileges to Administrator on a…
-
Critical 9.1
Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an af…
-
High 8.6
Cisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service Vulnerability
A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause a queue wedge on a leaf switch, which could result in critical control plane traffic to the de…
-
Unscored —
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.…
-
Medium 5.5
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client app…
-
High 8.7CVE-2021-22242 EPSS 64%
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a…
-
Medium 6.6
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impers…
-
Medium 5.0
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL …
-
Low 3.1
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a rep…
-
Medium 4.3
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/C…
-
Low 2.7
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages i…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentr…
-
Unscored —
A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions e…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation…
-
Unscored —
A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NE…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
Critical 9.6
Remote code execution in Binderhub
BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing Binde…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Ad…
-
High 8.8
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of COD…
-
Unscored —
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This …
-
Unscored —
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This …
-
Unscored —
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This …
-
Critical 9.6
Code injection in nbgitpuller
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2…
-
High 8.7
Cross-site scripting vulnerability in file upload
baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as…
-
Unscored —
Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'ch…
-
Unscored —
Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the …
-
Unscored —
Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive inform…
-
Unscored —
Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/…
-
Unscored —
The Webform module uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. CKEditor ha…
-
Unscored —
The *Admin Toolbar* (`admin_toolbar`) module extends the default toolbar provided by Drupal Core with various features …
-
Unscored —
The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (…
-
Medium 4.3
Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 …