Archive
15 December 2021
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 6.1
Cross-site Scripting in Anchor CMS
Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving ot…
-
Medium 6.7
Indirect LDAP injection in Tuleap
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A …
-
Medium 6.7
Indirect LDAP injection in Tuleap
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete. Tuleap does not sanitize properly the search filter built fro…
-
Medium 6.4CVE-2021-0920 Exploited
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…
KEV May 23, 2022 -
Medium 5.3CVE-2021-4119 EPSS 27%
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Medium 5.3
BMC firmware (IBM Power System S821LC Server (8001-12C) OP825.50) configuration changed to allow an authenticated user …
-
Medium 5.3
Missing authorization vulnerability in FatPipe software
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, …
-
Medium 4.3CVE-2021-43908 Public exploit
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
Medium 5.5
Microsoft PowerShell Spoofing Vulnerability
Microsoft PowerShell Spoofing Vulnerability
-
Medium 5.5
Windows Mobile Device Management Elevation of Privilege Vulnerability
Windows Mobile Device Management Elevation of Privilege Vulnerability
-
Medium 5.5
Microsoft Office Trust Center Spoofing Vulnerability
Microsoft Office Trust Center Spoofing Vulnerability
-
Medium 5.6
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 6.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 5.5
VP9 Video Extensions Information Disclosure Vulnerability
VP9 Video Extensions Information Disclosure Vulnerability
-
Medium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
Storage Spaces Controller Information Disclosure Vulnerability
-
Medium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
Storage Spaces Controller Information Disclosure Vulnerability
-
Medium 5.5CVE-2021-43224 Public exploit
Windows Common Log File System Driver Information Disclosure Vulnerability
Windows Common Log File System Driver Information Disclosure Vulnerability
-
Medium 6.5
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
-
Medium 5.5
Visual Basic for Applications Information Disclosure Vulnerability
Visual Basic for Applications Information Disclosure Vulnerability
-
Medium 6.5
Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Specific replication command with malformed oplog entries can crash secondaries
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27;…
-
Medium 5.4
Dolibarr Cross Site Scripting (XSS) vulnerability
A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.