Archive
15 November 2021
Vulnerabilities first published on this day (UTC), newest first.
66 results · Feed
-
Low —
ERC1155Supply vulnerability in OpenZeppelin Contracts
When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total sup…
-
Medium 4.8
Cache poisoning via maliciously-formed request in discourse
Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the …
-
Critical 10.0CVE-2021-41269 Public exploit
Unauthenticated remote code injection in cron-utils
cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, lead…
-
High 8.6CVE-2021-41266 EPSS 48%
Authentication bypass issue in the Operator Console
Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on…
-
High 8.3
Secure/signed cookies share secrets between sites in rails_multisite
rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these coo…
-
Critical 9.1
Cross organization admin control in Grafana
Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other o…
-
Unscored —
Arbitrary Write in AMD Graphics Driver for Windows 10 in Escape 0x40010d may lead to arbitrary write to kernel memory o…
-
Unscored —
AMD Graphics Driver for Windows 10, amdfender.sys may improperly handle input validation on InputBuffer which may resul…
-
Unscored —
Stack Buffer Overflow in AMD Graphics Driver for Windows 10 in Escape 0x15002a may lead to escalation of privilege or d…
-
Unscored —
Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privil…
-
Unscored —
Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation.
-
Unscored —
Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004403 may lead to arbitrary information disclosu…
-
Unscored —
Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure.
-
Unscored —
Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
-
Unscored —
An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execu…
-
Medium 6.4
XSS in Talk
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a n…
-
Unscored —
An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to…
-
Unscored —
Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/ad…
-
Unscored —
Pool/Heap Overflow in AMD Graphics Driver for Windows 10 in Escape 0x110037 may lead to escalation of privilege, inform…
-
Unscored —CVE-2021-41950 EPSS 75%
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete…
-
Unscored —CVE-2021-41765 EPSS 68%
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remot…
-
Unscored —
Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a…
-
Unscored —
A potential denial of service issue exists in the AMD Display driver Escape 0x130007 Call handler. An attacker with low…
-
Unscored —
Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or d…
-
Unscored —
Kernel Pool Address disclosure in AMD Graphics Driver for Windows 10 may lead to KASLR bypass.
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R64…
-
Low 3.7
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could…
-
Medium 4.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could…
-
Medium 5.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability all…
-
Medium 5.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information…
-
Medium 4.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that shoul…
-
Medium 5.9
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information…
-
Low 3.1
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or …
-
Medium 6.2
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read…
-
Medium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive info…
-
Medium 5.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of servic…
-
Unscored —
Arbitrary Read in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or denial of service.
-
Unscored —
An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users…
-
Unscored —CVE-2021-41951 EPSS 78%
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_s…