Archive
20 October 2021
Vulnerabilities first published on this day (UTC), newest first.
191 results · Feed
-
Critical 10.0CVE-2021-41163 EPSS 20%
RCE via malicious SNS subscription payload
Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, …
-
Medium 5.6
Microsoft Surface Pro 3 Security Feature Bypass Vulnerability
Microsoft Surface Pro 3 Security Feature Bypass Vulnerability
-
High 7.8
Directory Traversal in Babel
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
-
Unscored —
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of servic…
-
Unscored —
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay t…
-
Unscored —
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of servic…
-
Medium 6.1
IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar…
-
High 7.5
Unlimited requests in modern-async
modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency …
-
Unscored —
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxe…
-
Medium 6.5
Authz Module Non-Determinism
The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz modu…
-
Unscored —
ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities t…
-
Unscored —
ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities t…
-
Unscored —CVE-2021-21745 EPSS 56%
ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use t…
-
Unscored —
ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP r…
-
Unscored —
ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify t…
-
Unscored —
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie informati…
-
Unscored —
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie informati…
-
High 8.6
Prototype Pollution
This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
-
Medium 4.9
Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other interna…
-
Medium 4.3
Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
-
High 8.8
Camaleon CMS - Insufficient Session Expiration after Password Change
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
-
Medium 6.1
Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page…
-
Medium 5.9
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported ver…
-
Medium 6.1
Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported ver…
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
Medium 5.3
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported …
-
High 7.5
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported …
-
High 7.7
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported …
-
Critical 10.0
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported …
-
High 8.5
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported …
-
Medium 4.6
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported v…
-
Medium 5.4
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported v…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…