Archive
3 November 2021
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Medium 6.1
Deletion of arbitrary files vulnerability in Snow Agent for Windows
A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.
-
Unscored —CVE-2021-43032 Public exploit
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertis…
-
Unscored —CVE-2021-43339 Public exploit
In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via fil…
-
Unscored —
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…
-
Unscored —
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictl…
-
Unscored —
Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product C…
-
Unscored —
Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change sp…
-
Unscored —
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.
-
Unscored —
HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege.
-
Medium 5.5CVE-2021-38488 EPSS 12%
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute cod…
-
High 7.8
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.
-
Medium 5.5CVE-2021-38428 EPSS 11%
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.
-
High 7.8
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code.
-
Medium 5.9
Delta Electronics DIALink
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execu…
-
High 7.8
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges.
-
High 8.8
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remo…
-
Unscored —
HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available wit…
-
Unscored —CVE-2021-43141 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter …
-
Unscored —CVE-2021-43140 Public exploit
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
-
Medium 6.9CVE-2021-41174 EPSS 85%
XSS vulnerability allowing arbitrary JavaScript execution
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's…
-
Unscored —
PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search paramet…
-
Unscored —
ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter.
-
Unscored —
An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitr…
-
Unscored —
ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.p…
-
High 8.7
Stored XSS in Jupyter nbdime
nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension doe…
-
Medium —
Unexpected panics in num-bigint
### Impact Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic. - The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic. - A buffer was allocated wit…
-
Low 3.1
Cross-site Scripting (XSS)
This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
-
Medium 5.6
Prototype Pollution
This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
-
Medium 5.6
Prototype Pollution
This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
-
Medium 5.6
Prototype Pollution
This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
-
Medium 5.6
Prototype Pollution
This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.
-
Unscored —
An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial…
-
Unscored —
Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, v…
-
Unscored —
A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted B…
-
Unscored —
SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive in…
-
Unscored —
An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial …