Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
390 results · Clear filters · Feed
-
Medium 5.3CVE-2021-39211 Scanner template
Disclosure of GLPI and server information in telemetry endpoint
GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.p…
-
Medium 6.5
Autologin cookie accessible by scripts
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be …
-
Medium 5.3
Observable Response Discrepancy in Lost Password Service
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patc…
-
Medium 4.8
Use of Wrong Operator in String Comparison in hestiacp/hestiacp
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
-
Medium 6.6
Cross-site Scripting (XSS) - Reflected in yourls/yourls
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Exposure of sensitive information in Elasticsearch
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
-
Medium 6.3
Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
-
Medium 5.4
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
-
Medium 6.4
Microsoft Edge (Chromium-based) Tampering Vulnerability
Microsoft Edge (Chromium-based) Tampering Vulnerability
-
Medium 6.1
Microsoft Office Graphics Component Information Disclosure Vulnerability
Microsoft Office Graphics Component Information Disclosure Vulnerability
-
Medium 5.5
Windows Storage Information Disclosure Vulnerability
Windows Storage Information Disclosure Vulnerability
-
Medium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
-
Medium 5.7
Windows BitLocker Security Feature Bypass Vulnerability
Windows BitLocker Security Feature Bypass Vulnerability
-
Medium 6.5
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
-
Medium 6.5
Windows Key Storage Provider Security Feature Bypass Vulnerability
Windows Key Storage Provider Security Feature Bypass Vulnerability
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Windows SMB Information Disclosure Vulnerability
-
Medium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows Installer Information Disclosure Vulnerability
Windows Installer Information Disclosure Vulnerability
-
Medium 5.5
Windows Installer Denial of Service Vulnerability
Windows Installer Denial of Service Vulnerability
-
Medium 5.5
Windows Authenticode Spoofing Vulnerability
Windows Authenticode Spoofing Vulnerability
-
Medium 4.4
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
-
Medium 5.5
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
Medium 6.1
Cross-site Scripting in Beego
Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.
-
Medium 5.4
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Medium 5.3
IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. …
-
Medium 4.3
When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the…
-
Medium 5.3
Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encryp…
-
Medium 6.5
Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This a…
-
Medium 6.5
SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or dir…
-
Medium 6.5
SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over th…
-
Medium 6.1
Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This a…
-
Medium 5.4
The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to injec…
-
Medium 5.4
SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617,…
-
Medium 4.3
SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directo…
-
Medium 4.8
SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user …
-
Medium 6.1
When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social eng…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attac…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software ha…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software ha…