Archive
7 September 2021
Vulnerabilities first published on this day (UTC), newest first.
126 results · Feed
-
Unscored —
phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.
-
Unscored —
BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php.
-
Critical —
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown
### Impact A Remote Command Execution vulnerability was found in the rebber module, which allowed execution of arbitrary commands. The reported problem came from CodeBlocks, which could be escaped to insert malicious LaTeX. Anyone using `rebber` without sanit…
-
High —
Content object state fetch functions open to SQL injection
### Impact This Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that y…
-
Unscored —
A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.…
-
Unscored —
A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens…
-
Unscored —
A lack of target address verification in the BurnMe() function of Rob The Bank 1.0 allows attackers to steal tokens fro…
-
Unscored —
A lack of target address verification in the selfdestructs() function of ICOVO 1.0 allows attackers to steal tokens fro…
-
Unscored —
The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large number to the _duratio…
-
Unscored —
An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a r…
-
Critical 9.3
Preview generation used third-party library not suited for user-generated content in Nextcloud server
Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-sup…
-
Medium 5.5
Exceptions may have logged Encryption-at-Rest key content in Nextcloud server
Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud…
-
High 8.1
Bypass of Two Factor Authentication in Nextcloud server
Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain ac…
-
Medium 5.3
Nextcloud Text app can disclose existence of folders in "File Drop" link share
Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is p…
-
Medium 5.3
Lack of ratelimit on Richdocuments OCS endpoint in nextcloud
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended tha…
-
High 7.5
File Drop can be bypassed using Richdocuments app in nextcloud
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary fil…
-
Unscored —
EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout functio…
-
Unscored —
Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, …
-
Medium 5.8
Cross-Site Scripting in Nextcloud Circles
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped wit…
-
Medium 6.5
Secret Circle can be joined without approval in Nextcloud Circles
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is r…
-
Unscored —
A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitr…
-
Unscored —
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the save…
-
Unscored —
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to …
-
Unscored —
PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteCon…
-
Medium 6.5
Circle can be accessed by non-Circle members in Nextcloud Deck
Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other …
-
Unscored —
An issue was discovered in gpac 0.8.0. The gf_odf_del_ipmp_tool function in odf_code.c has a heap-based buffer over-rea…
-
Unscored —
The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.
-
Unscored —
An issue was discovered in gpac 0.8.0. The strdup function in box_code_base.c has a heap-based buffer over-read.
-
High 8.2
HTTP header injection in Sonatype Nexus Repository
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
-
Medium 4.3
Denial of service while parsing polymorphic input with tagged polymorphism style in kaml
kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsin…
-
Unscored —
ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticat…
-
Unscored —
Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to i…
-
Unscored —
Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce …
-
Unscored —
messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged at…
-
Unscored —
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass t…
-
Unscored —
A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissi…
-
High 7.7
Server-Side Request Forgery vulnerability in misskey
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within …
-
Unscored —
The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for up…
-
High 7.7
Authenticated non-privileged user can request unfiltered data without adequate permissions in pcapture
pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This …
-
Critical 10.0
Cross site scripting via unsafe defaults in remark-html
remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input…