Archive
3 December 2021
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
High 8.8
Improper Authentication in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
-
Unscored —
A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a craft…
-
Unscored —
Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/uploa…
-
Unscored —
A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated …
-
High 8.1
Deserialization of Untrusted Data
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
KEV Aug 26, 2026 -
Medium 4.2
Arbitrary File Upload
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
-
Unscored —
tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic…
-
Unscored —
tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in b…
-
Unscored —
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.c…
-
Unscored —
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.clas…
-
Unscored —
SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.
-
Unscored —CVE-2021-44352 EPSS 13%
A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter i…
-
Medium 5.4
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed …
-
Medium 5.4
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should…
-
Medium 4.3
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which co…
-
Medium 5.3
IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifyi…
-
Low 2.7
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user sho…
-
Medium 6.1
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed …
-
Medium 5.9
IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes…
-
Medium 5.3
Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
-
Medium 6.8
Persistent XSS via Avatar Upload in Kentico Xperience CMS
The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied …
-
Critical 9.8
Path manipulation in matyhtf/framework
matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.
-
Critical 9.8
Path traversal in librenms/librenms
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
-
Unscored —
ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only…
-
Unscored —
dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of t…
-
Unscored —
A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected in…
-
Unscored —
An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacke…
-
Unscored —
An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacke…
-
Unscored —
An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacke…
-
Unscored —
Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be…
-
Medium 6.5
Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site