Archive
October 2021
Vulnerabilities first published in this month (UTC), newest first.
346 results · Clear filters · Feed
-
High 7.2
SQL injection in the planning edition panel
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one…
-
High 7.1
Out-of-bounds Read in bfabiszewski/libmobi
libmobi is vulnerable to Out-of-bounds Read
-
High 7.8
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 8.8
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2
The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.
-
High 8.8
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1
The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.
-
High 8.8
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.
-
High 7.5CVE-2021-42340 EPSS 12%
DoS via memory leak with WebSocket connections
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket c…
-
High 8.8
Cross Site Request Forgery in kindeditor
A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.
-
High 8.8
Brizy <= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prep…
-
High 7.1
Brizy <= 1.0.125 and 1.0.127 – 2.3.11 Incorrect authorization checks allowing Post modification
The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An i…
-
High 8.8
DOS and Open Redirect with user input
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f…
-
High 7.5
Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email ad…
-
High 8.1
Reflected XSS vulnerability in time.php
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions …
-
High 8.1
GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProte…
-
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 7.5
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …
KEV Sep 3, 2024 -
High 8.8
Bypassing policy restrictions on regular users
Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true fo…
-
High 7.8CVE-2021-41357 Exploited
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Apr 25, 2022 -
High 7.5
SCOM Information Disclosure Vulnerability
SCOM Information Disclosure Vulnerability
-
High 8.0
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
-
High 7.8
Windows AppX Deployment Service Elevation of Privilege Vulnerability
Windows AppX Deployment Service Elevation of Privilege Vulnerability
-
High 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
Storage Spaces Controller Elevation of Privilege Vulnerability
-
High 8.1
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 7.8
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.0
Windows Desktop Bridge Elevation of Privilege Vulnerability
Windows Desktop Bridge Elevation of Privilege Vulnerability
-
High 7.8
Windows Media Audio Decoder Remote Code Execution Vulnerability
Windows Media Audio Decoder Remote Code Execution Vulnerability
-
High 7.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
-
High 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
Storage Spaces Controller Elevation of Privilege Vulnerability
-
High 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
Storage Spaces Controller Elevation of Privilege Vulnerability
-
High 8.1CVE-2021-40487 EPSS 48%
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Microsoft Word Remote Code Execution Vulnerability
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
High 7.6
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
High 7.6
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
High 7.1
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
High 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
Storage Spaces Controller Elevation of Privilege Vulnerability
-
High 7.8
Windows Event Tracing Elevation of Privilege Vulnerability
Windows Event Tracing Elevation of Privilege Vulnerability