Archive
5 November 2021
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
Medium 5.5
Crash in `max_pool3d` when size argument is 0 or negative
TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow's implementation of pooling operations w…
-
Medium 5.5
Crash in `tf.math.segment_*` operations
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large. This is similar to…
-
High 7.5CVE-2021-42359 Scanner template
WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it w…
-
High 7.4
Meross MSS550X Missing Encryption of Sensitive Data
Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in its initial setup. This could allow a remote attacker to obtain the Wi-Fi SSID as well as the passwor…
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to ch…
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained …
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained …
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.
-
Unscored —
An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not …
-
Medium 5.9
IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores auth…
-
Unscored —
Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to "Intege…
-
Unscored —
Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.
-
Unscored —
Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a "Data from Faulti…
-
Unscored —
Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php v…
-
High 7.8
AzeoTech DAQFactory
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory.
-
Medium 5.0
AzeoTech DAQFactory
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.
-
High 7.8
AzeoTech DAQFactory
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
-
Medium 5.7
AzeoTech DAQFactory
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.
-
Unscored —
Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) back…
-
High 8.8
Path Traversal in getgrav/grav
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 6.5
Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Unscored —
Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter i…
-
Unscored —CVE-2021-39411 Scanner template
Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) sear…
-
Unscored —
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitori…
-
Unscored —CVE-2021-42670 Public exploit
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the annou…
-
Unscored —
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which al…
-
Unscored —CVE-2021-42668 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_cl…
-
Unscored —
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-mana…
-
Unscored —CVE-2021-42666 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_ques…
-
Unscored —CVE-2021-42665 Public exploit
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of ind…
-
Unscored —CVE-2021-42664 Public exploit
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) …
-
Unscored —
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via t…
-
Unscored —CVE-2021-42662 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System …
-
Unscored —
A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject a…
-
Critical 9.8
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…
KEV Mar 25, 2022 -
Medium 5.9
A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite a…
-
Medium 5.3
Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abu…
-
Medium 5.7
Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC applic…
-
Medium 4.0
Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provide…
-
Low 3.3
Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is u…