Archive
9 November 2021
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Unscored —
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root passw…
-
Unscored —
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS …
-
Unscored —
KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local us…
-
Unscored —
Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title paramet…
-
Unscored —
Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflecte…
-
Critical 9.8
ecdsa-elixir fails to check signatures, vulnerable to message forging
The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
-
Critical 9.8
Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
-
Critical 9.8
Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
-
Critical 9.8
Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
-
Critical 9.8
Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
-
Unscored —
The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in u…
-
Unscored —
During installation with certain driver software or application packages an arbitrary code execution could occur.
-
High 7.5
gzip transfer encoding caused out-of-memory crash
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML…
-
Unscored —
Hanging RRDP request
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a…
-
High 7.5
Infinite length chain of RRDP repositories
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a ne…
-
Unscored —
In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
-
Unscored —
In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
-
Unscored —
In JetBrains Hub before 2021.1.13690, stored XSS is possible.
-
Unscored —
A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. For affect…
-
Unscored —
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
-
Unscored —
In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
-
Unscored —
In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, stored XSS is possible.
-
Unscored —
In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.
-
Unscored —
In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.
-
Unscored —
In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.
-
Unscored —
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
-
Unscored —
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
-
Unscored —
A Buffer Overflow and Information Disclosure issue exists in HP OfficeJet Pro Printers before 001.1937C, and HP PageWid…
-
Unscored —
In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.
-
Unscored —
In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.
-
Unscored —
JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.
-
Unscored —
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
-
Unscored —
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
-
Unscored —
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.