Archive
29 October 2021
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
A vulnerability was discovered in the filename parameter in pathindex.php?r=cms-backend/attachment/delete&sub=&filename…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can deadlock, which ma…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource…
-
High 7.0
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the …
-
High 7.1
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can double-free a poin…
-
High 7.8
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to…
-
Unscored —
A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms …
-
Unscored —
A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perfo…
-
High 7.2
Communities and collections administrators can escalate their privilege up to system administrator
DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This is…
-
Unscored —
SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Atta…
-
Unscored —CVE-2021-41646 Public exploit
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciousl…
-
Unscored —CVE-2021-41645 Public exploit
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a …
-
Unscored —CVE-2021-41644 Public exploit
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously cra…
-
Unscored —CVE-2021-41643 Public exploit
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload fi…
-
Medium 6.2
Heap-based Buffer Overflow in hoene/libmysofa
libmysofa is vulnerable to Heap-based Buffer Overflow
-
Unscored —
An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in action…
-
Unscored —
A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.p…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/log…
-
Medium 5.9
ReDoS vulnerability in parser_apache2
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apach…
-
Medium 5.0
Clickjacking Vulnerability
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, suc…
-
High 8.8
SQL Injection in DHIS2 Tracker API
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecifi…
-
Unscored —CVE-2021-3441 Public exploit
A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cros…
-
Unscored —
Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS).
-
Unscored —
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. Th…
-
Unscored —
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally …
-
Unscored —CVE-2021-31862 Public exploit
SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.
-
Unscored —
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows att…
-
Unscored —CVE-2021-31624 Public exploit
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows att…
-
Unscored —
Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attack…
-
High 7.6
Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.