Archive
9 December 2021
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server se…
-
Unscored —
A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote…
-
Medium 6.5
Insufficient Granularity of Access Control in GAEN Notification Server
An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.
-
Critical 9.8
SQL Injection in wbce/wbce_cms
wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
-
Medium 5.4
A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authe…
-
Medium 4.3
An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 a…
-
Medium 6.7
A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows att…
-
High 8.8
A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and …
-
High 7.8
A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, ve…
-
Medium 6.8
A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allo…
-
Medium 4.4
A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6…
-
Unscored —
airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements
Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 [1] of airavata-djan…
-
High 8.8
Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may all…
-
Medium 6.5
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …