Archive
16 December 2021
Vulnerabilities first published on this day (UTC), newest first.
44 results · Feed
-
Critical —
Critical vulnerability in log4j may affect generated PEAR projects
### Impact UIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228. ### Patches - The issue has been reso…
-
Unscored —
GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authenticati…
-
Medium 6.5
Malicious Atomix node queries expose sensitive information
An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.
-
Medium 5.9
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
-
High 8.1
An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
-
High 8.1
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
-
High 7.5
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node.
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext.
-
Medium 6.5
A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
-
High 7.5
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php usin…
-
High 8.4
Template injection in vault-cli
vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix `!template!`, vault-cli…
-
Medium 5.3
Vulnerable dependency in XTDB connector
### Impact The impacted portion of the XTDB connector is its connectivity to S3 as a backing store: this is the only portion of the connector that uses this vulnerable `httpclient` dependency. Per the description, the vulnerability regards URIs that may be mi…
-
Unscored —
In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting…
-
Unscored —
In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to…
-
Medium 6.4
Open redirect in nextjs-auth0
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. User…
-
Unscored —
A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to…
-
High 8.2
A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6…
-
High 8.1
Stored Cross-site Scripting in Galette
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by…
-
High 8.8
SQL Injection in Galette
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soo…
-
High 8.2
Missing CSRF checks in Galette
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There a…
-
Unscored —
JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
-
Unscored —CVE-2021-41962 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner f…
-
Unscored —CVE-2021-42912 EPSS 10%
FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows t…
-
High 7.1
Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZ…
-
Medium 6.8
Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone versions prior to 3.3…
-
High 8.1
Cross-site Scripting (XSS) - Stored in meetecho/janus-gateway
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.6
URL Address Bar Spoofing in F-Secure SAFE Browser for iOS
An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain,…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.4
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Unscored —
An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemo…
-
Unscored —
An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-l…
-
Unscored —
The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even th…
-
Unscored —
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an att…
-
Unscored —
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an …
-
Unscored —
pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
-
Unscored —
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection v…
-
Unscored —
A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products …
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is use…
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used…
-
Unscored —
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.