Archive
28 September 2021
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Unscored —
EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vulnerability in espcms_web\espcms_load.php.
-
Unscored —
Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.
-
Unscored —
Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/cont…
-
Critical 9.8
SQL Injection in topthink/thinkphp
ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
-
Medium 4.4
File reference keys leads to incorrect hashes on HMAC algorithms
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens …
-
High 7.8
SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load …
-
High 7.1
Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file delet…
-
Medium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated ma…
-
Medium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated ma…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Medium 6.8
Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with re…
-
Medium 6.8
Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote acce…
-
High 8.2
Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vu…
-
Unscored —
A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12, which can be exploited by an a…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain us…
-
Unscored —
A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. Tianyi Gatew…
-
Unscored —CVE-2021-41318 Public exploit
In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input…
-
Unscored —
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.
-
Unscored —
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
-
Unscored —
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
-
Unscored —
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
-
Unscored —
A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafte…
-
Unscored —
Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component. …
-
Unscored —
A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary…
-
Unscored —
A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary cod…
-
Unscored —
A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code…
-
Unscored —
A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code…
-
Unscored —
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary …
-
Unscored —
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary …
-
Unscored —
A buffer overflow vulnerability in FORMATS!ReadPVR_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of servi…
-
High 7.5
web_server allows OTA update without checking user defined basic auth username & password
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic …
-
Unscored —
There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper ver…
-
Unscored —
There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when pr…
-
Unscored —
There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). This vulnerability…
-
Unscored —
Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting versio…
-
Unscored —
Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) pr…
-
High 8.8
Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inje…
-
Unscored —
An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 al…