Archive
14 December 2021
Vulnerabilities first published on this day (UTC), newest first.
116 results · Feed
-
Unscored —
When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - ve…
-
Unscored —
When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterpri…
-
Unscored —
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameteriz…
-
Unscored —
Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privil…
-
Unscored —
When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Ent…
-
Unscored —
SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should …
-
Unscored —
A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usag…
-
Unscored —
SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided …
-
Unscored —
Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 75…
-
Unscored —
Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An at…
-
Unscored —
SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for …
-
Unscored —
An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and w…
-
Unscored —
An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions…
-
Unscored —
An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of so…
-
Critical 9.8
Improper Restriction of XML External Entity Reference in dbeaver/dbeaver
dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
-
High 7.4
SMTPS server hostname not checked when making TLS connection to SMTPS server
Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. Fo…
-
High 7.8
Rapid7 Insight Agent Privilege Escalation
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DL…
-
Medium 5.3
Cross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Unscored —
An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a m…
-
Unscored —
glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.
-
Unscored —
An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.
-
Medium 4.4
Sysaid - Sysaid API User Enumeration
Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server.
-
Unscored —
taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.
-
Unscored —
There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update…
-
Unscored —
The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session obj…
-
Unscored —
An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privi…
-
Unscored —
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker …
-
Unscored —
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), …
-
Unscored —
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), …
-
Unscored —
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), …
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK l…
-
Unscored —
A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK l…