Archive
27 September 2021
Vulnerabilities first published on this day (UTC), newest first.
115 results · Feed
-
Medium 6.3
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
-
Medium 5.4
Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
-
Unscored —
In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can b…
-
Unscored —
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A u…
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on…
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the web…
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments.
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass.
-
Unscored —
In ccu, there is a possible out of bounds read due to incorrect error handling. This could lead to information disclosu…
-
Unscored —
In m4u, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege…
-
Unscored —
In m4u, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege…
-
Unscored —
In memory management driver, there is a possible memory corruption due to an integer overflow. This could lead to local…
-
Unscored —
In memory management driver, there is a possible side channel information disclosure. This could lead to local informat…
-
Unscored —
In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local d…
-
Unscored —
In memory management driver, there is a possible information disclosure due to uninitialized data. This could lead to l…
-
Unscored —
In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local d…
-
Unscored —
In memory management driver, there is a possible information disclosure due to a missing bounds check. This could lead …
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF.
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regu…
-
Unscored —
An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution v…
-
Unscored —
On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11…
-
Unscored —
A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add…
-
High 7.5
Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS
Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests.
-
Medium 5.3
Improper Access Control in passport-oauth2
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error r…
-
Critical 9.8
Improper Access Control in Webauthn Framework
Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
-
Unscored —
The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtai…
-
Unscored —
Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not con…
-
Unscored —
ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the p…
-
Unscored —
e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET…
-
High 7.5
furlongm openvpn-monitor command injection
furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIGTERM.
-
Medium 5.3
furlongm openvpn-monitor allows CSRF to disconnect an arbitrary client
furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.
-
Critical 9.8
Command Injection Vulnerability in QVR
A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.…
-
High 7.2
Command Injection Vulnerability in QVR
A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.…
-
Critical 9.8
Command Injection Vulnerability in QVR
A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.…
-
High 7.5
furlongm openvpn-monitor allows Authorization Bypass to disconnect arbitrary clients
furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.