Archive
13 October 2021
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
Unscored —
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module A…
-
Unscored —CVE-2021-40493 EPSS 50%
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs…
-
Medium 5.3
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and…
-
High 7.5
Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email ad…
-
Medium 4.3
Denial of service in DataCommunicator class in Vaadin 8
Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
-
Unscored —
Side-channels Related to the x86 PREFETCH Instruction
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
-
Unscored —
SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
-
Unscored —
Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.
-
Unscored —CVE-2021-20131 EPSS 17%
ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improp…
-
Unscored —CVE-2021-20130 EPSS 33%
ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improp…
-
Unscored —
Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerabilit…
-
Unscored —
Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An att…
-
High 8.1
Reflected XSS vulnerability in time.php
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions …
-
Critical 9.8
TIBCO EBX Insecure Login Mechanism
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password othe…
-
Unscored —
This module enables aklump/loft\_data\_grids to be used as a Drupal module. Excel support was provided by <https://pack…
-
High 8.1
GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProte…
-
Medium 6.1
XMP Toolkit SDK Null Pointer Dereference
XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory locations and causing a local denial of service in the context of the current user. User interaction is requ…
-
Unscored —
VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling.…
-
Unscored —
VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interac…
-
Unscored —
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker t…
-
Unscored —
The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerabl…
-
Unscored —
An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Drayte…
-
Unscored —
Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a w…
-
Unscored —
An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileS…
-
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
Unscored —
Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.
-
Medium 5.3
Validity check for signed Frontier-specific extrinsic not called in block execution
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Ma…
-
Unscored —
Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass.
-
Unscored —
Proofpoint Spam Engine before 8.12.0-2106240000 has a Security Control Bypass.
-
High 8.8
Bypassing policy restrictions on regular users
Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true fo…
-
Medium 4.3
Denial of service in DataCommunicator class in Vaadin 8
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
-
Unscored —
Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 a…
-
Unscored —
The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows…
-
Unscored —
InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerab…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack t…
-
Unscored —
Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote att…
-
Unscored —
Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitr…
-
Unscored —
Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote aut…
-
Unscored —
Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) conditio…