Archive
19 October 2021
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, iTunes 12.12 f…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Sec…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15. A m…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina, m…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Sec…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6. A local u…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Sec…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in watchOS 8, macOS Big Sur 11.6, Security Update 20…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8,…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8,…
-
Unscored —
An access issue was addressed with improved access restrictions. This issue is fixed in Security Update 2021-005 Catali…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPa…
-
High 7.1
Use of Out-of-range Pointer Offset in bfabiszewski/libmobi
libmobi is vulnerable to Use of Out-of-range Pointer Offset
-
High 7.1
Use of Out-of-range Pointer Offset in bfabiszewski/libmobi
libmobi is vulnerable to Use of Out-of-range Pointer Offset
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.8
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 8.6
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
-
Medium 5.5
Cross-site Scripting (XSS) - Generic in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.0
Open Redirect in firefly-iii/firefly-iii
firefly-iii is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.3
Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
-
High 8.0
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute …
-
Critical 9.1
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device.
-
Critical 9.6
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to cross-site request forgery when unauthorized commands are submitted from a user the web application trusts. This may allow an attacker to remotely perform actions on the rou…
-
Critical 9.1
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files to the server, which may allow an attacker, acting as an administrator, to upload malicious files. Th…
-
High 8.7
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 website used to control the router is vulnerable to stored cross-site scripting, which may allow an attacker to hijack sessions of users connected to the system.
-
Medium 4.7
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router’s management portal and coul…
-
Medium 6.5
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts.
-
Critical 9.8
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations …
-
High 8.8
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the help page. This may allow an attacker to perform a reflected cross-site scripting attack, which could allow an attacker …
-
Medium 6.4
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to intercept the communication and steal sensitive information or hijack the session.
-
High 8.7
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker to hijack sessions of users connected to the system.
-
Critical 9.1
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device.
-
Medium 6.3
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harmin…
-
Unscored —
An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers …
-
Unscored —CVE-2021-42261 Public exploit
Revisor Video Management System (VMS) before 2.0.0 has a directory traversal vulnerability. Successful exploitation cou…
-
Medium 5.4
OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemap
In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page c…
-
Unscored —
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privil…
-
High 7.5
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…
-
High 7.5
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…