Archive
9 September 2021
Vulnerabilities first published on this day (UTC), newest first.
140 results · Feed
-
Medium 4.0
An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows att…
-
Medium 4.0
An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows att…
-
Low 3.3
NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory c…
-
Medium 5.9
An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get …
-
Medium 5.5
OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcp…
-
Low 3.3
OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitr…
-
Low 3.1
OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remot…
-
Medium 5.1
Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Blue…
-
Medium 5.5
An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows a…
-
Low 3.3
A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI d…
-
Medium 4.5
Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file …
-
Medium 6.5
An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to …
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'e…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains …
-
Unscored —
An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading…
-
Unscored —
A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to …
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 …
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allow…
-
Unscored —
A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/Ap…
-
Unscored —
A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to admini…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attacke…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login se…
-
Unscored —
D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerabil…
-
Unscored —
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Critical 9.8
Apache Airflow: Variable Import endpoint missed authentication check
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclo…
-
Medium 5.0
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
-
Unscored —CVE-2020-19515 Scanner template
qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
-
Unscored —
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
-
Unscored —
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
-
Unscored —
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
-
Unscored —
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in th…
-
Unscored —
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the…
-
High 7.5
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) p…
-
Unscored —
There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to i…