Archive
3 November 2021
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Medium 6.1
Deletion of arbitrary files vulnerability in Snow Agent for Windows
A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.
-
Medium 5.5CVE-2021-38488 EPSS 12%
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute cod…
-
Medium 5.5CVE-2021-38428 EPSS 11%
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code.
-
Medium 5.9
Delta Electronics DIALink
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execu…
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remo…
-
Medium 6.9CVE-2021-41174 EPSS 85%
XSS vulnerability allowing arbitrary JavaScript execution
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's…
-
Medium —
Unexpected panics in num-bigint
### Impact Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic. - The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic. - A buffer was allocated wit…
-
Medium 5.4
Cross-site Scripting (XSS)
This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
-
Medium 5.6
Prototype Pollution
This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
-
Medium 5.6
Prototype Pollution
This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
-
Medium 5.6
Prototype Pollution
This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
-
Medium 5.6
Prototype Pollution
This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.
-
Medium 6.1
Cross-site Scripting in LibreNMS
LibreNMS through 21.10.2 allows XSS via a widget title.
-
Medium 5.2
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, …