Archive
9 December 2021
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Medium 5.8
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium —
Server side request forgery in SwaggerUI
SwaggerUI supports displaying remote OpenAPI definitions through the `?url` parameter. This enables robust demonstration capabilities on sites like `petstore.swagger.io`, `editor.swagger.io`, and similar sites, where users often want to see what their OpenAPI…
-
Medium 5.9
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expe…
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclo…
-
Medium 5.5
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local u…
-
Medium 5.9
IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as u…
-
Medium 4.8
NSM vulnerable to XSS
Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not c…
-
Medium 4.6
Session fixation in express-openid-connect
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application…
-
Medium 6.5
Insufficient Granularity of Access Control in GAEN Notification Server
An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.
-
Medium 5.4
A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authe…
-
Medium 4.3
An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 a…
-
Medium 6.7
A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows att…
-
Medium 6.8
A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allo…
-
Medium 4.4
A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6…
-
Medium 6.5
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …