Archive
October 2021
Vulnerabilities first published in this month (UTC), newest first.
1,718 results · Feed
-
Unscored —
In display driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Unscored —
In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of ser…
-
Unscored —
In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of ser…
-
Unscored —
In ccu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local informati…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local informati…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Medium 5.4
Piranha CMS - Stored XSS in Page Title
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
-
Unscored —
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron Ap…
-
Medium 6.7
Unquoted Path (SMB Login) Vulnerability
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerab…
-
Critical 9.8
Unsafe Pre-Authentication Deserialization In Workers
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgra…
-
Critical 9.8
Shell Command Injection Vulnerability in Nimbus Thrift Server
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authenti…
-
Medium 4.8
Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker…
-
High 8.6
Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and i…
-
Unscored —
Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution,…
-
High 7.8
PHP-FPM memory access in root process leading to privilege escalation
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child proc…
-
Critical 9.8
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…
KEV Nov 3, 2021 -
Unscored —
Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensiti…
-
Unscored —
Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder fun…
-
Unscored —
Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the pa…
-
Unscored —
Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers t…
-
Unscored —
MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handli…
-
Unscored —
Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in t…
-
Unscored —
Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the pa…
-
Unscored —
Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module. This v…
-
Unscored —
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pi…
-
Unscored —
Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via th…
-
Unscored —
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php…
-
Unscored —
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the componen…
-
Unscored —
Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnera…