Archive
3 November 2021
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Unscored —
An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain esca…
-
Unscored —CVE-2020-20982 Scanner template
Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain e…
-
Unscored —
An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbi…
-
Unscored —
Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attac…
-
Unscored —
Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/…
-
Unscored —
heap-buffer-overflow with stats-over-http plugin
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.
-
Unscored —
ATS stops accepting connections on FreeBSD
Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0.
-
Unscored —
Not validating origin TLS certificate
Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.
-
Unscored —
Request Smuggling - multiple attacks
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
-
Unscored —
Request Smuggling - transfer encoding validation
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1.
-
Unscored —
Request Smuggling - LF line ending
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the usern…
-
Medium 6.1
Cross-site Scripting in LibreNMS
LibreNMS through 21.10.2 allows XSS via a widget title.
-
Unscored —
With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager componen…
-
Unscored —
Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.
-
Medium 5.2
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, …
-
Unscored —
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable…
-
Unscored —
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet…
-
Unscored —
An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether…
-
Unscored —
An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can (in the WebUI) obtain plant information …
-
High 7.5
Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked fro…
-
Unscored —
An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller m…
-
Unscored —
Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential …
-
Unscored —CVE-2021-39238 EPSS 11%
Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulner…
-
Unscored —
Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a…
-
Unscored —
Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI s…
-
Unscored —
Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerabi…
-
Unscored —
When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers t…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed e…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of me…
-
Unscored —
During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corru…
-
Unscored —
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another …
-
Unscored —
During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed ev…
-
Unscored —
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downg…