Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited…
-
Unscored —
fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c.
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a craf…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a …
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a cra…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploit…
-
Unscored —
libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via …
-
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Unscored —
An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg f…
-
Unscored —
A cross-site scripting (XSS) vulnerability in RGCMS v1.06 allows attackers to obtain the administrator's cookie via a c…
-
Unscored —
An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt fil…
-
Unscored —
An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file.
-
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Unscored —
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
-
Unscored —
Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.prope…
-
High —
Arbitrary Code Execution in feehi/cms
An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
-
Unscored —
emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to a…
-
Critical —
UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable
### Impact Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. ### Patches A fix is included in version 4.3.2 of `@openzeppelin…
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Critical 9.8
HGiga OAKlouds - Command Injection-2
The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system…
-
Critical 9.8
HGiga OAKlouds - Command Injection-1
The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the sys…
-
Critical 9.8
CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation
WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.
-
Unscored —
HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to …
-
Medium 6.3
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions tha…
-
Critical 9.1
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 20…
-
Critical 9.9
SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script …
-
High 8.1
The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Serve…
-
High 7.0
SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstanc…
-
Medium 5.9
SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Admi…
-
Medium 6.9
NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting i…
-
Medium 5.7
SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject mali…
-
Medium 4.7
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow a…
-
Medium 6.8
Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validatio…
-
Medium 5.2
SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject…
-
Medium 5.4
SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode …
-
Critical 9.9
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Comp…
-
Medium 5.4
IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modi…
-
Medium 5.9
IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …
-
Medium 6.5
IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in fu…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows r…