Archive
7 September 2021
Vulnerabilities first published on this day (UTC), newest first.
126 results · Feed
-
Unscored —
The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal p…
-
Medium 6.3
Cross-Site Request Forgery in better_errors
better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its…
-
Unscored —
Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker …
-
Unscored —
Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018…
-
Critical 9.8
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…
KEV Nov 3, 2021 -
High 8.8
RAONWIZ DEXT5 Upload remote code execution vulnerability
A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUploadFile, SetSelectItem, DoOpenFile function.(CVE-2020-7832)
-
High 8.8
Inoguard ExECM CoreB2B solution remote code execution vulnerability
A vulnerability(improper input validation) in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbitrary file via httpDownload function. A successful exploit could allow the attacker to hijack vulnerable system.
-
Critical 9.3
nTracker USB Enterprise SQL-Injection vulnerability
A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information.
-
Unscored —
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in th…
-
Unscored —
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive …
-
Unscored —
A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Softw…
-
Unscored —
A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web inte…
-
Unscored —
A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Op…
-
Unscored —
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Soft…
-
Unscored —
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Soft…
-
Unscored —
A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operatin…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior …
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operatin…
-
Medium 4.6
Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AV engine scanner). The vulnerability can be exploit remotely by an attacker. A successful attack wil…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior …
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operatin…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operatin…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operatin…
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operatin…
-
Unscored —
A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): …
-
Unscored —
A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Sof…
-
Medium 6.5
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
-
High 8.0
ZOOK solution(remote administration tool) buffer overflow vulnerability
A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a crafted OUTERIP value because of missing boundary check. This vulnerability allows the attacker to execute remote arbitr…
-
High 8.8
Privilege escalation in Hashicorp Nomad
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
-
Medium 5.4
Synerion TimeNet version 9.21 - Directory Traversal
Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could pro…
-
High 8.8
HashiCorp Consul Privilege Escalation Vulnerability
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
-
High 7.6
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any …
-
High 8.8
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to cr…
-
Medium 6.3
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-…
-
Unscored —
Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulne…
-
Critical 9.8
Unsafe deserialization in providers using the Hessian protocol
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serializati…
-
High 8.8
Unprotected yaml deserialization cause RCE
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order …
-
Unscored —
The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversi…
-
Unscored —
The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of …