Archive
21 October 2021
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
Unscored —
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
-
Medium 6.2
Improper Neutralization HTML tags in sulu/sulu
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags…
-
Medium 4.8
WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
-
High 7.3
Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa
Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz…
-
Medium 6.5
Hash-Collision Denial-of-Service Vulnerability in snudown
Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in m…
-
Medium 4.8
Easy Digital Downloads <= 2.11.2 Authenticated Reflected Cross-Site Scripting
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web script…
-
High 8.8
Sassy Social Share 3.3.23 PHP Object Injection
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admi…
-
Medium 5.5
Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed …
-
High 7.2
Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it …
-
Medium 5.5
Content Staging <= 2.0.1 Authenticated Stored Cross-Site Scripting
The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via several parameters that are echo'd out via the ~/templates/settings.php file which allowed attackers with administrative us…
-
Medium 5.5
Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site Scripting
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions…
-
Medium 5.5
LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site Scripting
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to …
-
Unscored —
Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.
-
Critical 9.8
Adobe Connect Deserialization of Untrusted Data Remote Code Execution
Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF messages are deserialized on an Adobe Connect server. An attacker can leverage this to execute remote c…
-
Unscored —
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when …
-
Medium 5.5
Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attac…
-
Medium 4.7
Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM
The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.
-
Medium 5.0
Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potentia…
-
High 8.8
Arbitrary command execution on Windows in qutebrowser
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserur…
-
Medium 5.7
In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs t…
-
Medium 4.3
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute o…
-
High 8.8
IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of servic…
-
Unscored —
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron Ap…
-
Unscored —
The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forger…
-
Unscored —
WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted serv…
-
Unscored —
The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the …
-
Critical 9.8
Improper Neutralization of Special Elements used in a Command in Shell-quote
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted arg…
-
Unscored —
An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.
-
Unscored —
An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-tra…
-
Unscored —
An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An e…
-
Unscored —
An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allow…
-
Unscored —
Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free …
-
Unscored —
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0…
-
Unscored —
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0…
-
Unscored —
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0…
-
Unscored —
Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0…
-
Unscored —
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a loc…
-
Unscored —
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allo…
-
Unscored —
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a loc…
-
Unscored —
An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local …