Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
Unscored —
A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to …
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 …
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allow…
-
Unscored —
A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/Ap…
-
Unscored —
A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to admini…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attacke…
-
Unscored —
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login se…
-
Unscored —
D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerabil…
-
Unscored —
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Unscored —
In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of se…
-
Critical 9.8
Apache Airflow: Variable Import endpoint missed authentication check
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclo…
-
Medium 5.0
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
-
Unscored —CVE-2020-19515 Scanner template
qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
-
Unscored —
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
-
Unscored —
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
-
Unscored —
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
-
Unscored —
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in th…
-
Unscored —
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the…
-
High 7.5
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) p…
-
Unscored —
There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to i…
-
High 8.8
handysoft groupware arbitrary file download and execution vulnerability
An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash.
-
High 8.8
NEXACRO14 Runtime arbitrary file download and execution vulnerability
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or …
-
High 8.8
Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker t…
-
Critical 9.6
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditi…
-
High 8.4
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditi…
-
High 7.2
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditi…
-
Medium 4.4
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditi…
-
Medium 6.3
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account password…
-
High 8.7
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords…
-
Unscored —
Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS …
-
Unscored —
Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS …
-
Unscored —
Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an aut…
-
Unscored —
Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an aut…
-
Unscored —CVE-2021-38408 EPSS 12%
A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper v…
-
Medium 5.5
WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &nam…
-
Medium 5.5
WordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilities
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name, &wpgmza_gdpr_retention_purpose, &wpgmza_gdpr_company_name, &name #2, &name, &polyname #…
-
High 8.6
bandisoft ARK library heap overflow vulnerability
A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability is due to missing support for string length check.