Archive
15 September 2021
Vulnerabilities first published on this day (UTC), newest first.
37 results · Clear filters · Feed
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Medium 6.3
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions tha…
-
Medium 5.9
SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Admi…
-
Medium 6.9
NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting i…
-
Medium 5.7
SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject mali…
-
Medium 4.7
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow a…
-
Medium 6.8
Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validatio…
-
Medium 5.2
SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject…
-
Medium 5.4
SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode …
-
Medium 5.4
IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modi…
-
Medium 5.9
IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …
-
Medium 6.5
IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in fu…
-
Medium 6.8
DOM-based XSS/Content Spoofing via Prototype Pollution
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this …
-
Medium 6.8
IP restriction on GLPI API Bypass with custom header injection
GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as…
-
Medium 5.3
Disclosure of GLPI and server information in telemetry endpoint
GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.p…
-
Medium 6.5
Autologin cookie accessible by scripts
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be …
-
Medium 5.3
Observable Response Discrepancy in Lost Password Service
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patc…
-
Medium 4.8
Use of Wrong Operator in String Comparison in hestiacp/hestiacp
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
-
Medium 6.6
Cross-site Scripting (XSS) - Reflected in yourls/yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Exposure of sensitive information in Elasticsearch
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
-
Medium 6.3
Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
-
Medium 5.4
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
-
Medium 6.4
Microsoft Edge (Chromium-based) Tampering Vulnerability
Microsoft Edge (Chromium-based) Tampering Vulnerability
-
Medium 6.1
Microsoft Office Graphics Component Information Disclosure Vulnerability
Microsoft Office Graphics Component Information Disclosure Vulnerability
-
Medium 5.5
Windows Storage Information Disclosure Vulnerability
Windows Storage Information Disclosure Vulnerability
-
Medium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
-
Medium 5.7
Windows BitLocker Security Feature Bypass Vulnerability
Windows BitLocker Security Feature Bypass Vulnerability
-
Medium 6.5
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
-
Medium 6.5
Windows Key Storage Provider Security Feature Bypass Vulnerability
Windows Key Storage Provider Security Feature Bypass Vulnerability
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Windows SMB Information Disclosure Vulnerability
-
Medium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows Installer Information Disclosure Vulnerability
Windows Installer Information Disclosure Vulnerability
-
Medium 5.5
Windows Installer Denial of Service Vulnerability
Windows Installer Denial of Service Vulnerability
-
Medium 5.5
Windows Authenticode Spoofing Vulnerability
Windows Authenticode Spoofing Vulnerability
-
Medium 4.4
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
-
Medium 5.5
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability