Archive
November 2021
Vulnerabilities first published in this month (UTC), newest first.
36 results · Clear filters · Feed
-
Low 3.5
UI Redressing in TopEase
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution.
-
Low 3.1
Microsoft Edge for iOS Spoofing Vulnerability
Microsoft Edge for iOS Spoofing Vulnerability
-
Low 3.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Low 2.7
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a r…
-
Low 3.7
GateManager does not enforce strict hostname matching for WEB server
This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause browser cache poisoning.
-
Low 3.3
Rapid7 Nexpose Information Disclosure after logout
Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available i…
-
Low 3.3
Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low priv…
-
Low 3.3
Adobe Animate SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Animate versions 21.0.9 (and earlier)is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue req…
-
Low 3.0
Ambiguous OCI manifest parsing
### Impact In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of containerd prior to 1…
-
Low 3.0
Clarify `mediaType` handling
### Impact In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index. ### Patches The Image Specification will be updat…
-
Low 3.0
Clarify Content-Type handling in OCI spec
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during…
-
Low 3.1
OSIsoft PI Vision
PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a Limits property.
-
Low —
ERC1155Supply vulnerability in OpenZeppelin Contracts
When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total sup…
-
Low 3.7
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could…
-
Low 3.1
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or …
-
Low 3.9
Cross-site Scripting (XSS) - Generic in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Low 2.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrect…
-
Low 3.7CVE-2021-37910 Public exploit
ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
-
Low 3.7
HTML injection in Zoom Linux client
In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the process of in-meeting screen sharing. This could allow meeting participants to be targeted for social…
-
Low 3.7
Retained exploded messages in Keybase Clients for Android and iOS
The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by a user if the receiving user places the chat session in the background while the sending user explo…
-
Low 3.3
Azure RTOS Information Disclosure Vulnerability
Azure RTOS Information Disclosure Vulnerability
-
Low 3.3
Azure RTOS Information Disclosure Vulnerability
Azure RTOS Information Disclosure Vulnerability
-
Low 2.3
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
-
Low 3.3
Azure RTOS Information Disclosure Vulnerability
Azure RTOS Information Disclosure Vulnerability
-
Low 2.7
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, w…
-
Low 3.3
Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is u…
-
Low 3.7
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may a…
-
Low 1.7
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting…
-
Low 2.7
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiti…
-
Low 2.6
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a proj…
-
Low 3.1
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause…
-
Low 3.5
incomplete logout in JupyterHub
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-us…
-
Low 3.1
Cross-site Scripting (XSS)
This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
-
Low 3.2
An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5…
-
Low 3.5
An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below ma…
-
Low 3.1
A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the cust…