Archive
November 2021
Vulnerabilities first published in this month (UTC), newest first.
332 results · Clear filters · Feed
-
Medium 6.2
IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of …
-
Medium 6.2
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS to expose sens…
-
Medium 6.2
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the libc.a library…
-
Medium 5.0
An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, …
-
Medium 6.2
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local …
-
Medium 4.4
IBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem audit logging records bef…
-
Medium 6.1
FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality
In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting (XSS) at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
-
Medium 6.1
FactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories Functionality
In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and…
-
Medium 6.1
FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality
In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the sessi…
-
Medium 4.3
TVN-202110009
The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.
-
Medium 4.8
Cache poisoning via maliciously-formed request in discourse
Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the …
-
Medium 6.4
XSS in Talk
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a n…
-
Medium 4.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could…
-
Medium 5.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability all…
-
Medium 5.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information…
-
Medium 4.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that shoul…
-
Medium 5.9
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information…
-
Medium 6.2
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read…
-
Medium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive info…
-
Medium 5.4
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of servic…
-
Medium 5.4
AzeoTech DAQFactory
This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.
-
Medium 6.1
Grand Vice info Co. webopac7 - Reflected XSS
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks.
-
Medium 6.3
ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory Buffer
ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attackers can modify the BIOS by replacing or filling in the content of the designated Memory DataBuffer, w…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
-
Medium 5.5
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted…
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in area17/twill
twill is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.9
Reflected XSS Vulnerability in QmailAgent
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Qma…
-
Medium 6.8
Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privi…
-
Medium 6.5
Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. A…
-
Medium 6.7
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local…
-
Medium 6.5
An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allo…
-
Medium 5.3
Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encryp…
-
Medium 6.5
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow …
-
Medium 6.5
A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allo…
-
Medium 4.2
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow …