Archive
8 September 2021
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
Medium 6.5
OpenStack Neutron Denial of Service vulnerability
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amo…
-
Medium 5.4
Cross-site Scripting in LibreNMS
In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.
-
Medium 6.5
PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface
An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the f…
-
Medium 4.3
Adobe Media Encoder VOB file parsing out-of-bounds read could lead to information disclosure vulnerability
Adobe Media Encoder version 15.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of t…
-
Medium 5.8
Adobe Genuine Services insecure file permission could lead to privilege escalation
Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the context of the curre…
-
Medium 5.0
Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Acces…
-
Medium 4.3
Adobe Illustrator memory corruption vulnerability could lead to information disclosure
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the c…
-
Medium 6.3
Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior …
-
Medium 6.4
Improper Authentication in SaltStack Salt
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …
KEV Nov 3, 2021 -
Medium 5.5
Possible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon Auto, Snapdragon Comput…
-
Medium 6.2
Lack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdr…
-
Medium 4.6
Buffer over read could occur due to incorrect check of buffer size while flashing emmc devices in Snapdragon Connectivi…
-
Medium 6.2
Child process can leak information from parent process due to numeric pids are getting compared and these pid can be re…
-
Medium 5.6
An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reus…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via a…
-
Medium 6.5
The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and…