Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
Critical 9.6
Digi PortServer TS 16 Improper Authentication
Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and…
-
High 7.8
Delta Electronics DOPSoft 2 Heap-based Buffer Overflow
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the c…
-
High 7.8
Delta Electronics DOPSoft 2 Stack-Based Buffer Overflow
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacke…
-
High 7.8
Delta Electronics DOPSoft 2 Out-of-Bounds Write
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute cod…
KEV Aug 25, 2022 -
Unscored —
An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1…
-
Unscored —
A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and includ…
-
Unscored —
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain mes…
-
Unscored —
nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. …
-
Unscored —
Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged…
-
Unscored —
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExt…
-
Unscored —
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
-
Unscored —
The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allow…
-
Unscored —
The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (wi…
-
Medium 6.2
Fix prototype pollution in the zrender merge and clone helper methods
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization libr…
-
Medium 6.5
Memory Safety Issue when using patch or merge on state and assign the result back to state
Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, aff…
-
High 8.2
Local Privilege Escalation in McAfee DLP Endpoint for Windows
A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local sy…
-
High 8.4
Remote Code Execution in McAfee DLP Discover
A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro (.sam) files onto a machine and …
-
High 7.3
Improper access control vulnerability in McAfee ENS for Windows
Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would otherwise not have access to via manipulating junction links to redirect McAfee fo…
-
Medium 5.0
XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 20…
-
Medium 5.3
BulletProof Security <= 5.1 Sensitive Information Disclosure
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database…
-
High 8.6
Prototype Pollution
This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.
-
Critical 9.8CVE-2021-41303 EPSS 76%
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
-
High 8.4
Possible integer and heap overflow due to lack of input command size validation while handling beacon template update c…
-
High 8.4
Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extsca…
-
Critical 9.8
A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Sna…
-
High 8.4
Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Sna…
-
High 8.4
Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdra…
-
Medium 6.7
Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.7
Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.5
Inefficient Regular Expression Complexity in cdr/code-server
code-server is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in nervjs/taro
taro is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —
Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a …
-
Unscored —
Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and …
-
Unscored —
Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to bypass access rest…
-
Unscored —
Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to exec…
-
High 7.5
Prototype Pollution in mariocasciaro/object-path
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 7.5
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in fb55/nth-check
nth-check is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.
-
Unscored —CVE-2021-41314 EPSS 14%
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several fa…