Archive
7 October 2021
Vulnerabilities first published on this day (UTC), newest first.
70 results · Feed
-
Unscored —CVE-2021-37921 EPSS 11%
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —CVE-2021-37923 EPSS 11%
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —CVE-2021-37924 EPSS 11%
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —
Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files f…
-
Unscored —CVE-2021-37918 EPSS 74%
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Unscored —CVE-2021-37926 EPSS 74%
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code exec…
-
Medium 5.4
Integria IMS vulnerable to Cross Site Scripting (XSS)
Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).
-
Critical 9.8
Integria IMS incorrect authorization
Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in …
-
High 7.8
Adobe Acrobat Reader DC AcroForm listbox Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm listbox that could result in arbitrary code execution in the context…
-
High 7.8
Adobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm field that could result in arbitrary code execution in the context o…
-
Unscored —
ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffe…
-
Unscored —
In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the C…
-
Unscored —
Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sni…
-
Medium 4.3
SilverStripe GraphQL Server permission checker not inherited by query subclass.
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
-
Medium 6.1
Cross-site Scripting in SilverStripe Framework
SilverStripe Framework through 4.8.1 allows XSS.
-
Unscored —
HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities t…
-
High 8.2
Server-Side Request Forgery vulnerability in concrete5
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services expo…
-
Critical 9.8
Integria IMS Remote Code Execution
Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload() function in order to exploit the vulnerability.
-
High 7.5
Directory traversal in mkdocs
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://g…
-
Unscored —
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in th…
-
Unscored —
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve X…
-
Unscored —
ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.
-
Medium 6.1CVE-2021-42053 Public exploit
Cross-site scripting in Unicorn framework
The Unicorn framework through 0.35.3 for Django allows XSS via component.name.
-
Unscored —
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to …
-
Unscored —
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an…
-
Unscored —CVE-2021-22930 EPSS 36%
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…