Archive
November 2021
Vulnerabilities first published in this month (UTC), newest first.
1,522 results · Feed
-
Medium 5.8
Intent URI permissions manipulation in nextcloud news-android
nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that…
-
High 8.1
Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote…
-
Medium 6.5
Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malic…
-
High 8.8
Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may…
-
Medium 5.3
Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unau…
-
Medium 6.5
Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). …
-
Medium 6.5
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Unscored —CVE-2021-40101 Public exploit
An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a pr…
-
Unscored —
An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (wi…
-
Unscored —
The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous u…
-
High 7.5
douzone NeoRS remote support program ActiveX vulnerability
The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program. This issue allows an remote attacker to download and execute remote file. It is because of improper parameter validation of StartNeoRS function in ActiveX.
-
Unscored —
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.
-
Unscored —CVE-2021-43319 EPSS 21%
Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper valida…
-
Medium 6.5
Deserialization of Untrusted Data in Spring AMQP
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
-
Unscored —
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
-
Unscored —
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
-
High 8.1
tobesoft Nexacro platform arbitrary file creation vulnerability
An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.
-
Unscored —
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
-
High 8.8
ipTIME C200 IP Camera command injection vulnerability
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wge…
-
Unscored —
An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its defa…
-
Unscored —
An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the…
-
Unscored —
An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone wit…
-
Unscored —
PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 datab…
-
Medium 5.9
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensit…
-
Medium 5.1
IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within tra…
-
High 8.2
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-For…
-
Medium 5.1
IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. IBM X-Forc…
-
Unscored —
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
-
Critical 9.1
HashiCorp Vault Incorrect Permission Assignment for Critical Resource
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy…
-
Medium 5.0
Hexo - Stored XSS
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
-
Unscored —
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application databas…
-
Unscored —
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application databas…
-
Unscored —
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application databas…
-
High 8.1
Insufficient Session Expiration in TopEase
An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.
-
High 7.3
Missing Upload Filter in TopEase
Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enablin…
-
High 7.5
Lack of Rate limiting in Authentication in TopEase
Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticated remote attacker to perform multiple login attempts, which facilitates gaining privileges.
-
Medium 4.3
Denial of Service via Invalid Object Attribute in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to inser…
-
Medium 4.3
Denial of Service via Invalid Date Format in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpect…
-
Medium 6.5
Missing Character Length (Denial of Service) in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long st…
-
High 7.3
Stored XSS in Search Function in TopEase
Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScr…