Archive
10 November 2021
Vulnerabilities first published on this day (UTC), newest first.
32 results · Clear filters · Feed
-
Medium 6.1CVE-2021-33618 EPSS 79%
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
-
Medium 5.5
An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed on a jailbroken device,…
-
Medium 5.7CVE-2021-3572 Public exploit
Improper Input Validation in pip
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This i…
-
Medium 6.4
PAN-OS: OS Command Injection Vulnerability in the Command Line Interface (CLI)
An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions …
-
Medium 6.1
Improper Verification of Communication Channel in @theia/plugin-ext
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
-
Medium 5.5
Broken Access Control Vulnerability in Jovi Smart Scene
The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.
-
Medium 5.4
Cross-site Scripting in pegasus/google-for-jobs
An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit t…
-
Medium 4.3
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information from applicati…
-
Medium 4.8
Phoenix Contact: FL MGUARD XSS through web-based management and REST API
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.
-
Medium 5.4
Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File Upload
In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
-
Medium 5.4
Publify - Stored Cross-Site Scripting (XSS) in Editor
In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.
-
Medium 4.7
Visual Studio Elevation of Privilege Vulnerability
Visual Studio Elevation of Privilege Vulnerability
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
-
Medium 6.6
Azure RTOS Elevation of Privilege Vulnerability
Azure RTOS Elevation of Privilege Vulnerability
-
Medium 6.6
Azure RTOS Elevation of Privilege Vulnerability
Azure RTOS Elevation of Privilege Vulnerability
-
Medium 6.6
Azure RTOS Elevation of Privilege Vulnerability
Azure RTOS Elevation of Privilege Vulnerability
-
Medium 6.0
Azure Sphere Tampering Vulnerability
Azure Sphere Tampering Vulnerability
-
Medium 5.7
Windows Hello Security Feature Bypass Vulnerability
Windows Hello Security Feature Bypass Vulnerability
-
Medium 6.8
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.5
Windows Feedback Hub Elevation of Privilege Vulnerability
Windows Feedback Hub Elevation of Privilege Vulnerability
-
Medium 4.2
Chakra Scripting Engine Memory Corruption Vulnerability
Chakra Scripting Engine Memory Corruption Vulnerability
-
Medium 5.5
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
-
Medium 6.8
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability
-
Medium 5.5
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
KEV Mar 3, 2022 -
Medium 4.4
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
-
Medium 6.7
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
-
Medium 5.5
FSLogix Information Disclosure Vulnerability
FSLogix Information Disclosure Vulnerability
-
Medium 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
-
Medium 6.1
Microsoft Access Remote Code Execution Vulnerability
Microsoft Access Remote Code Execution Vulnerability
-
Medium 4.3CVE-2021-41351 Public exploit
Microsoft Edge (Chrome based) Spoofing on IE Mode
Microsoft Edge (Chrome based) Spoofing on IE Mode
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
-
Medium 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability