Archive
21 September 2021
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —CVE-2021-41382 Public exploit
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
-
Unscored —
Heap-buffer overflow in the randomize_iparp function in edit_packet.c. of Tcpreplay v4.3.2 allows attackers to cause a …
-
Unscored —
An issue was discovered in gpac 0.8.0. The stbl_GetSampleSize function in isomedia/stbl_read.c has a heap-based buffer …
-
Unscored —
An issue was discovered in gpac 0.8.0. The gf_hinter_track_process function in isom_hinter_track_process.c has a heap-b…
-
Unscored —
An issue was discovered in gpac 0.8.0. The OD_ReadUTF8String function in odf_code.c has a heap-based buffer overflow wh…
-
Medium 5.6
Improperly Implemented path matching for in-toto-golang
in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations …
-
High 8.7
Clipboard-based XSS in jsuites
jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copyi…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-b…
-
Unscored —
Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in corefra…
-
Unscored —
Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause …
-
High 8.7
Response Splitting from unsanitized headers in http4s
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header valu…
-
Unscored —CVE-2021-40847 EPSS 10%
The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve…
-
Medium 5.6
Prototype Pollution
This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
-
High 8.8
Error in JPNS kernel of Butter
Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
-
Unscored —CVE-2021-40868 Public exploit
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
-
High 7.1
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Inj…
-
Medium 6.0
IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence o…
-
Unscored —
An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexN…
-
Unscored —
Invalid RPKI data could disable Route Origin Validation on RTR clients.
NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validati…
-
Unscored —
ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
-
Unscored —
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
-
Unscored —
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
-
Unscored —
ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
-
Unscored —
Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handli…
-
Unscored —
In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check.…
-
Unscored —
AMD Chipset Driver Information Disclosure Vulnerability
An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow low privileged users to open a handle and send requests to the driver resulting in a potential data …
-
Unscored —
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An att…
-
Unscored —
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows …
-
Unscored —
SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads …