Archive
28 October 2021
Vulnerabilities first published on this day (UTC), newest first.
106 results · Feed
-
Unscored —
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted .cr2 f…
-
Unscored —CVE-2020-23546 Public exploit
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM fi…
-
Critical 9.1
Improper Access Control in jupyterhub-firstuseauthenticator
FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any us…
-
Unscored —
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php.…
-
Unscored —
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_catego…
-
Unscored —
A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attacke…
-
Unscored —
A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=b…
-
Unscored —
A cross site scripting (XSS) vulnerability in menuedit.php of Mara CMS 7.5 allows attackers to execute arbitrary web sc…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, i…
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tv…
-
Unscored —CVE-2021-30833 EPSS 43%
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.0.1. Unpacking a maliciously cr…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Process…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, Se…
-
Unscored —
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, S…
-
Unscored —
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.5. A malicious appl…
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 15, watchOS 8, iOS 15 a…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPad…
-
Unscored —
A memory corruption issue was addressed with improved input validation. This issue is fixed in tvOS 15, watchOS 8, iOS …
-
Unscored —
The issue was addressed with improved permissions logic. This issue is fixed in iOS 15 and iPadOS 15. An attacker with …
-
Unscored —
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvO…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. A malic…
-
Unscored —CVE-2021-30809 Public exploit
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchO…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in watchOS 7.6, macOS Big Sur 11.5. Vis…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.0.1. A person with access to a …
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A mali…
-
Unscored —
An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.2 and iPadOS 14.2, m…
-
High 8.0
Unrestricted Upload of File with Dangerous Type in flatcore/flatcore-cms
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
-
Medium 5.7
Improper Access Control in github.com/treeverse/lakefs
### Impact 1. [medium] A user with write permissions to a portion of a repository may use the S3 gateway to copy any object in the repository if they know its name. 1. [medium] A user with permission to write any one of tags, branches, or commits on a reposit…
-
High 7.5
RAONWIZ DEXT5 Upload ActiveX remote file execution vulnerability
DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.
-
Medium 6.5
Deserialization of Untrusted Data in Spring AMQP
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.uti…
-
Medium 4.3
Improper Output Neutralization for Logs in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
-
Medium 5.3
Exposure of Resource to Wrong Sphere in Spring Data REST
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that …
-
High 7.5
Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@Reque…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester News247 CMS 1.0 via the search function in articles.
-
Unscored —
A cross-site scripting (XSS) vulnerability was discovered in the OJ/admin-tool /cal_scores.php function of HZNUOJ v1.0.
-
High 7.1
Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender Gravity…
-
High 7.8
Privilege escalation via SeImpersonatePrivilege
Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but withi…
-
High 7.8
Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe
Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This iss…
-
Unscored —
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain…
-
Medium 6.7
Certificate verification vulnerability in Update Manager of PCM600 Engineering Tool
A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600 installed.