Archive
1 September 2021
Vulnerabilities first published on this day (UTC), newest first.
115 results · Feed
-
Unscored —
The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host rac…
-
High 7.2CVE-2021-39115 Public exploit
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Adminis…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving …
-
Unscored —
WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background lin…
-
Unscored —
WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management m…
-
Unscored —
WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu manage…
-
Unscored —
WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows…
-
Unscored —
WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the backg…
-
Unscored —
WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post componen…
-
Unscored —
An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privileg…
-
Unscored —
An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authentica…
-
Medium 4.3
Improper Input Validation in GlobalNewFiles
GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3ed…
-
High 8.8
Unsafe Deserialization of User Data Using XStream
OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used…
-
Unscored —
YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
-
Unscored —
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sen…
-
Critical 9.1
Default CORS config allows any origin with credentials
Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The mid…
-
Medium 5.6
Prototype Pollution
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that…
-
Unscored —
Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user…
-
Unscored —
Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Bu…
-
Medium 5.6
Prototype Pollution
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto_…
-
High 8.8
Remote code execution in Eclipse Theia
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 do…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and se…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allow…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi all…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/kill…
-
Medium 4.3
IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the retur…
-
Medium 5.4
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 4.3
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned…
-
High 7.8
Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution
Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to…
-
High 7.8
Adobe Bridge SGI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Bridge version 11.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .SGI file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute c…
-
High 7.8
Adobe Bridge Buffer Overflow leads to Arbitrary Code Execution
Adobe Bridge version 11.1 (and earlier) is affected by a Buffer Overflow vulnerability due to insecure handling of a malicious Bridge file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to e…
-
Medium 5.5
Adobe Bridge SVG File Memory Corruption Could Lead To Application Denial Of Service
Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in local application denial of service in the context of the current user. User interaction is req…
-
High 7.8
Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Adobe Bridge version 11.1 (and earlier) is affected by a heap-based buffer overflow vulnerability when parsing a crafted .SGI file. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue re…
-
High 7.8
XMP Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution
XMP Toolkit SDK version 2020.1 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a c…
-
High 7.8
Adobe Bridge PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to…
-
High 7.8
Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution
Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to…
-
Low 3.3
Adobe Bridge PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requir…
-
High 7.8
Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution
Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to…
-
Low 3.3
Adobe Bridge PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requir…