Archive
1 December 2021
Vulnerabilities first published on this day (UTC), newest first.
76 results · Feed
-
Unscored —
Events Manager < 5.9.8 - Cross-Site Scripting (XSS)
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
-
Unscored —
Events Manager < 5.9.8 - Admin+ SQL Injection
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection
-
Unscored —
Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This fi…
-
Unscored —CVE-2021-33265 EPSS 14%
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —CVE-2021-33266 EPSS 17%
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Unscored —
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer o…
-
Medium 4.3
Bypass of Poll voting limits in Discourse
Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse
-
Medium 5.3
Anonymous user cache poisoning via development-mode header in Discourse
Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. …
-
Medium 4.3
Notifications leak in Discourse
Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags…
-
Unscored —
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 vi…
-
High —
RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution. ### Impact A malicious actor with write a…
-
Medium —
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …
-
Medium —
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …
-
Unscored —
SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in …
-
Medium 5.4
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attack…
-
Medium 5.4
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Medium 5.9
IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key ex…
-
Medium 5.9
IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …
-
Unscored —
CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.
-
Unscored —
chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an att…
-
Unscored —
AMD Chipset Driver Information Disclosure Vulnerability
The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
-
High 7.5
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/…
-
High 7.5
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CP…
-
High 7.5
Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Ser…
-
High 7.3
Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wi…
-
Unscored —
Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to liste…
-
Unscored —
libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/…
-
Medium 6.1
NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of…
-
Medium 6.1CVE-2021-40154 Public exploit
NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration re…
-
Unscored —
manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Control…
-
Medium 5.4
CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload
In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim…
-
Medium 6.1
Cross-site Scripting in LibreNMS
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
-
Medium 6.1
Cross-site Scripting in LibreNMS
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
-
Unscored —
attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the mak…
-
Unscored —
YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. The exit function will te…