Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
High 7.5
A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote att…
-
Unscored —
A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Netw…
-
Unscored —
An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks versi…
-
Unscored —
Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its …
-
Unscored —
Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access s…
-
Medium 5.9
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS …
-
High 7.5
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…
-
Unscored —
EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vulnerability in espcms_web\espcms_load.php.
-
Unscored —
Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.
-
Unscored —
Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/cont…
-
Critical 9.8
SQL Injection in topthink/thinkphp
ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
-
Medium 4.4
File reference keys leads to incorrect hashes on HMAC algorithms
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens …
-
High 7.8
SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load …
-
High 7.1
Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file delet…
-
Medium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated ma…
-
Medium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated ma…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Medium 6.8
Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with re…
-
Medium 6.8
Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote acce…
-
High 8.2
Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vu…
-
Unscored —
A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12, which can be exploited by an a…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain us…
-
Unscored —
A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. Tianyi Gatew…
-
Unscored —CVE-2021-41318 Public exploit
In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input…
-
Unscored —
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.
-
Unscored —
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
-
Unscored —
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
-
Unscored —
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
-
Unscored —
A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafte…
-
Unscored —
Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component. …
-
Unscored —
A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary…
-
Unscored —
A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary cod…
-
Unscored —
A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code…
-
Unscored —
A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code…
-
Unscored —
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary …
-
Unscored —
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary …
-
Unscored —
A buffer overflow vulnerability in FORMATS!ReadPVR_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of servi…
-
High 7.5
web_server allows OTA update without checking user defined basic auth username & password
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic …