Archive
27 October 2021
Vulnerabilities first published on this day (UTC), newest first.
70 results · Feed
-
Low 3.7
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set …
-
Unscored —
A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected ver…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0 via the username …
-
Unscored —
CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.
-
Unscored —
The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.
-
Unscored —
A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update…
-
Unscored —
Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allow…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Complaint Management System 1.0 via the cid parameter in compla…
-
Unscored —
In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning an…
-
Unscored —
An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the applicat…
-
Unscored —
In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration…
-
Unscored —
Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by a…
-
High 7.5
Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0
In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.
-
Low 3.1
Missing Secure Flag From SSL Cookie
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie …
-
Medium 5.3
ASP.NET Debug Feature Enabled
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The infor…
-
Medium 5.3
Advantech WebAccess/NMS Improper Authentication
WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed v…
-
Unscored —
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing infor…
-
Medium 5.3
HTTP TRACK & TRACE Methods Enabled
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was r…
-
Unscored —
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to …
-
Unscored —
A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileg…
-
Unscored —
Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and …
-
Critical 9.9
Trane Tracer Code Injection
The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
-
High 7.2
godomall5 remote code execution vulnerability
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
-
High 8.0
Helpu arbitrary file creation vulnerability
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the …
-
Unscored —
There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a m…
-
Unscored —
There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit thi…
-
Unscored —
There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses e…
-
Unscored —
There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the s…
-
Unscored —
There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special cha…
-
Unscored —
There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high pr…