Archive
15 September 2021
Vulnerabilities first published on this day (UTC), newest first.
154 results · Feed
-
Medium 6.5
Autologin cookie accessible by scripts
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be …
-
Unscored —
A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated bo…
-
Unscored —
A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated bou…
-
Unscored —
A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code executio…
-
Unscored —
A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated bou…
-
Unscored —
The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.
-
High 7.5
Inefficient Regular Expression Complexity in sindresorhus/semver-regex
semver-regex is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —
A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-ex…
-
Unscored —
MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
-
Unscored —
MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
-
Unscored —
UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
-
Critical 9.8
Remote code execution in UReport
An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
-
High —
Server-Side Request Forgery in UReport
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
-
Unscored —
Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_…
-
Unscored —
The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because…
-
High 8.8
Bypassable CSRF protection
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. Th…
-
Unscored —
A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerabilit…
-
Unscored —
A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through…
-
Unscored —
Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/…
-
Unscored —
Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via th…
-
Unscored —
Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' paramete…
-
Unscored —
Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' paramete…
-
Unscored —
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or…
-
Unscored —
Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a mal…
-
Unscored —
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via th…
-
Unscored —
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cau…
-
Unscored —
Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the '…
-
Unscored —
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via th…
-
Unscored —
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via th…
-
Medium 5.3
Observable Response Discrepancy in Lost Password Service
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patc…
-
Unscored —
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a…
-
High 8.8CVE-2021-21798 EPSS 21%
An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.…
-
Medium 4.8
Use of Wrong Operator in String Comparison in hestiacp/hestiacp
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
-
Unscored —
PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript U…
-
High 7.5
Inefficient Regular Expression Complexity in prismjs/prism
prism is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —CVE-2021-40845 Public exploit
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload i…
-
High 7.7
Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON …
-
High 7.5
Inefficient Regular Expression Complexity in vuelidate/vuelidate
vuelidate is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —
VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), an…
-
High 8.8
Cross-site Scripting (XSS) - Stored in yourls/yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')