Archive
8 December 2021
Vulnerabilities first published on this day (UTC), newest first.
35 results · Clear filters · Feed
-
Medium 6.5
Possible Access to Debug Functions in Bosch VRM / BVMS
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and B…
-
Medium 5.0
Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS
An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVA…
-
Medium 6.1
SYNEL - eharmonynew / Synel Reports version 8.0.2 Default credentials , Security miscommunication , Sensetive data exposure
SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data (Employee name, Employee ID number, Working hours etc') The vulnerabilety has been addressed and fi…
-
Medium 6.7
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit…
-
Medium 4.2
Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 thr…
-
Medium 5.4
An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.…
-
Medium 6.5
Instance config inline secret exposure
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two end…
-
Medium 4.0
Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute priv…
-
Medium 4.0
Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account I…
-
Medium 4.0
Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Acc…
-
Medium 5.3
Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to …
-
Medium 4.0
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get…
-
Medium 5.9
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16…
-
Medium 4.0
An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC …
-
Medium 6.4
An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write…
-
Medium 6.4
An improper check or handling of exceptional conditions in Exynos baseband prior to SMR Dec-2021 Release 1 allows attac…
-
Medium 4.0
An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSS…
-
Medium 6.1
An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain ac…
-
Medium 6.3
An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitr…
-
Medium 5.3
An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code exec…
-
Medium 5.3
An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Rep…
-
Medium 6.1
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4…
-
Medium 6.1
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4…
-
Medium 5.5
A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below a…
-
Medium 4.1
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below al…
-
Medium 6.1
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4…
-
Medium 4.3
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and …
-
Medium 6.3
An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2…
-
Medium 5.3
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSa…
-
Medium 5.4
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6…
-
Medium 6.4
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6…
-
Medium 6.3
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may all…
-
Medium 6.1
Denial of Service in Database Security on Windows
A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed…
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management acces…