Archive
October 2021
Vulnerabilities first published in this month (UTC), newest first.
448 results · Clear filters · Feed
-
Medium 4.7
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Microsoft DWM Core Library Elevation of Privilege Vulnerability
-
Medium 5.5CVE-2021-41338 Public exploit
Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability
Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability
-
Medium 4.9
Active Directory Security Feature Bypass Vulnerability
Active Directory Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 6.5
Windows Print Spooler Information Disclosure Vulnerability
Windows Print Spooler Information Disclosure Vulnerability
-
Medium 5.3
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
Medium 5.5
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
-
Medium 5.5
Windows Bind Filter Driver Information Disclosure Vulnerability
Windows Bind Filter Driver Information Disclosure Vulnerability
-
Medium 6.5
Windows Remote Procedure Call Runtime Security Feature Bypass Vulnerability
Windows Remote Procedure Call Runtime Security Feature Bypass Vulnerability
-
Medium 5.3
Windows AD FS Security Feature Bypass Vulnerability
Windows AD FS Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Installer Spoofing Vulnerability
Windows Installer Spoofing Vulnerability
-
Medium 5.5
Rich Text Edit Control Information Disclosure Vulnerability
Rich Text Edit Control Information Disclosure Vulnerability
-
Medium 5.5
Windows exFAT File System Information Disclosure Vulnerability
Windows exFAT File System Information Disclosure Vulnerability
-
Medium 5.5
Windows Fast FAT File System Driver Information Disclosure Vulnerability
Windows Fast FAT File System Driver Information Disclosure Vulnerability
-
Medium 6.5
Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr
Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3
-
Medium 6.8
Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user…
-
Medium 5.3
IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. IBM…
-
Medium 5.9
IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to d…
-
Medium 5.7
TIBCO JasperReports unauthorized access to temporary object
The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIB…
-
Medium 4.8
Session Management Vulnerability
The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could…
-
Medium 4.3
Apache Traffic Control Traffic Ops Email Injection Vulnerability
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitr…
-
Medium 6.5
Prototype Pollution
All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
-
Medium 6.7
Code exec via yaml parsing
Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting f…
-
Medium 6.1
Cross-site Scripting in django-unicorn
The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
-
Medium 5.3
MediaWiki allows a denial of service
MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
-
Medium 6.5
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain poten…
KEV Nov 3, 2021 -
Medium 6.1
Cross-site Scripting in Limesurvey
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
-
Medium 5.1
IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to …
-
Medium 5.3
Tad Uploader - Improper Authorization
Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.
-
Medium 5.3
Tad Web - Improper Authorization
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
-
Medium 6.1
Tad Uploader - Stored XSS
The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
-
Medium 6.1
Tad TadTools - Reflected XSS
TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.
-
Medium 5.3
Tad Honor - Improper Authorization
Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.
-
Medium 6.1
Tad Book3 - Stored XSS
Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
-
Medium 6.5
XML External Entity Reference in org.opencms:opencms-core
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
-
Medium 5.5
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successfu…
-
Medium 5.5
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in certain F-Secure products can crash while scanning a fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack …
-
Medium 4.3
Regular expression denial-of-service in Zulip
Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious …