Archive
12 November 2021
Vulnerabilities first published on this day (UTC), newest first.
31 results · Clear filters · Feed
-
Medium 6.8
Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privi…
-
Medium 6.5
Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. A…
-
Medium 6.7
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local…
-
Medium 6.5
An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allo…
-
Medium 5.3
Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encryp…
-
Medium 6.5
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow …
-
Medium 6.5
A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allo…
-
Medium 4.2
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow …
-
Medium 6.8
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker w…
-
Medium 6.4
A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local a…
-
Medium 4.4
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad …
-
Medium 5.5
An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and…
-
Medium 6.7
A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from…
-
Medium 4.3
A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enha…
-
Medium 6.7
A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an…
-
Medium 6.4
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when …
-
Medium 6.5
Credentials leak
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
-
Medium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrect…
-
Medium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrect…
-
Medium 4.0
IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missin…
-
Medium 5.4
IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Medium 6.5
XXE vulnerability in Jenkins pom2config Plugin
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for e…
-
Medium 6.5
XXE vulnerability in Jenkins Performance Plugin
Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scrip…
-
Medium 5.4CVE-2021-21699 EPSS 88%
Stored XSS vulnerability in Jenkins Active Choices Plugin
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
-
Medium 6.7
Possible use after free due to improper memory validation when initializing new interface via Interface add command in …
-
Medium 6.7
Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing …
-
Medium 6.7
Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto,…
-
Medium 6.7
Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concu…
-
Medium 5.3
Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon o…
-
Medium 4.3
Memory leak in BlueZ
BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over …