Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
Unscored —
JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web…
-
Unscored —
FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.
-
Unscored —
FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.
-
Unscored —
A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60_EN allows remote attackers to execute arbit…
-
Unscored —
Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to en…
-
Medium 5.7
CORS `Access-Control-Allow-Origin` settings are too lenient
wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Origin ` header set by `nginz` is set for all subdomains of `.wire.com` (including `wire.com`). This means that if somebo…
-
Unscored —
REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.
-
Unscored —
Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via…
-
Unscored —
Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite persona…
-
Unscored —CVE-2021-41288 EPSS 80%
Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
-
Unscored —
NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.
-
Unscored —
NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.
-
Unscored —
NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.
-
Unscored —
NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQu…
-
Unscored —
NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
-
Unscored —
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.
-
Unscored —
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.
-
Unscored —
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.
-
Unscored —
rudp v0.6 was discovered to contain a memory leak in the component main.c.
-
Unscored —
libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.
-
Unscored —
libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.
-
Unscored —
libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.
-
Medium 5.9
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algori…
-
Medium 5.4
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorize…
-
Medium 6.1
IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users…
-
Medium 5.4
An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign …
-
Low 3.7
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 an…
-
High 7.5
LiveQuery publishes user session tokens
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently no…
-
Low 3.3
Adobe Acrobat Reader DC URI Parsing Out-Of-Bounds Read
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to locally escal…
-
Unscored —
BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitra…
-
High 7.3
ECOA BAS controller - Missing Encryption of Sensitive Data
ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege.
-
Critical 9.8
ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authen…
-
Critical 9.8
ECOA BAS controller - Insufficiently Protected Credentials-2
ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality.
-
Critical 9.8
ECOA BAS controller - Use of Hard-coded Credentials
ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in.
-
High 8.8
ECOA BAS controller - Improper Access Control
ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypa…
-
High 8.8
ECOA BAS controller - Insufficiently Protected Credentials-1
ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text.
-
Critical 9.8
ECOA BAS controller - Weak Password Requirements
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
-
High 8.8
ECOA BAS controller - Cross-Site Request Forgery (CSRF)
ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations in the system.
-
Critical 9.1
ECOA BAS controller - Path Traversal-4
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.
-
High 7.5CVE-2021-41293 EPSS 20%
ECOA BAS controller - Path Traversal-3
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system in…