Archive
8 December 2021
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
High 7.8CVE-2021-43811 Public exploit
Code injection via unsafe YAML loading
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary c…
-
High 8.8
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.…
-
High 7.2
Authenticated Remote Code Execution
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 and VJ…
-
High 7.8
APM Java Agent Local Privilege Escalation
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to…
-
High 8.8
Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 thr…
-
High 7.3
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.…
-
High 8.0
A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 th…
-
High 7.1
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows user…
-
High 7.8
A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user t…
-
High 8.0
Prototype Pollution in fabiocaccamo/utils.js
utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 7.1
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate pri…
-
High 7.7
An improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrar…
-
High 7.5
A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenti…
-
High 7.3
A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute…
-
High 8.1
An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an …
-
High 7.5
A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retr…
-
High 7.5
A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may a…
-
High 8.8
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6…
-
High 8.3
A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.…
-
High 8.8
An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote at…
-
High 8.1
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management …
-
High 7.8
An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0…
-
High 8.8
Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method all…
-
High 7.5
Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that…
-
High 8.8
KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.
-
High 7.5
KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.