Archive
13 December 2021
Vulnerabilities first published on this day (UTC), newest first.
108 results · Feed
-
High 7.5
SHL, SHR, and SAR operations trigger native exception at key values in besu
Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed …
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.
-
Unscored —
A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior t…
-
Medium 6.5
Side-channel attack in Sourcegraph
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searc…
-
High 8.5
SQL injection in jackalope/jackalope-doctrine-dbal
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to res…
-
High 8.2
Reflected Cross-Site-Scripting vulnerability in Collabora Online
Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora On…
-
High 7.7
Heap-based OOB write when parsing dwarf DIE info in Rizin
Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF bi…
-
High 7.5
Uncaught Exception in mercurius
Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https…
-
Medium 6.5
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an atta…
-
Medium 4.2
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow…
-
Medium 5.3
IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bo…
-
Medium 5.3
IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bo…
-
Medium 6.2
IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds check…
-
Medium 5.1
IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sen…
-
Medium 6.8
The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agen…
-
High 8.1
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an…
-
High 8.2
HTML Cleaner allows crafted and SVG embedded scripts to pass through
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…
-
High 8.1
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the…
-
Medium 5.9
IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles…
-
Medium 5.9
IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allo…
-
Medium 5.4
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the…
-
Medium 5.9
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information, cau…
-
Medium 5.6
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console wi…
-
Medium 5.9
IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allo…
-
Unscored —
-
Unscored —
The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.
-
Unscored —
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
-
High 7.8
WECON LeviStudioU
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code.
-
Unscored —
There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudE…
-
Unscored —
There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is caused by improper log…
-
Critical 9.8
OmniCore RobotWare Missing Authentication Vulnerability
A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port.
-
Medium 4.3
Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and …
-
Medium 6.5
An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14…
-
Low 3.7
An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 all…
-
Medium 6.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…
KEV Feb 3, 2026 -
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions star…
-
Medium 4.3
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions s…
-
Medium 4.3
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the con…
-
Medium 4.4
In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all…