Archive
November 2021
Vulnerabilities first published in this month (UTC), newest first.
68 results · Clear filters · Feed
-
Unscored —CVE-2021-40577 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP a…
-
Unscored —CVE-2021-24807 Public exploit
Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically e…
-
Unscored —CVE-2021-24664 Public exploit
WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
-
Unscored —CVE-2021-24647 Public exploit
Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site b…
-
Medium 5.3
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Th…
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained …
-
Unscored —
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitori…
-
Unscored —CVE-2021-42670 Public exploit
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the annou…
-
Unscored —
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which al…
-
Unscored —CVE-2021-42668 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_cl…
-
Unscored —
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-mana…
-
Unscored —CVE-2021-42666 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_ques…
-
Unscored —CVE-2021-42665 Public exploit
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of ind…
-
Unscored —CVE-2021-42664 Public exploit
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) …
-
Unscored —CVE-2021-42663 Public exploit
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via t…
-
Unscored —CVE-2021-42662 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System …
-
Critical 9.8
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…
KEV Mar 25, 2022 -
Critical 10.0CVE-2021-40113 Public exploit
Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a d…
-
Unscored —CVE-2021-43032 Public exploit
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertis…
-
Unscored —CVE-2021-43339 Public exploit
In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via fil…
-
Unscored —CVE-2021-43141 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter …
-
Unscored —CVE-2021-43140 Public exploit
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
-
Unscored —
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communic…
-
Unscored —CVE-2017-5123 Public exploit
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
-
High 7.5
Uncontrolled Recursion in Akka HTTP
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
-
Unscored —CVE-2021-37980 Public exploit
Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially…
-
Unscored —
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual…
-
High 8.3CVE-2021-42694 Public exploit
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allow…