Archive
22 December 2021
Vulnerabilities first published on this day (UTC), newest first.
117 results · Feed
-
Unscored —
Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java compon…
-
Unscored —
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
-
Unscored —
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitr…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.1…
-
Unscored —
A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user…
-
Unscored —
A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrat…
-
Unscored —
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave…
-
Unscored —
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search functio…
-
High 8.7
Cross-Site Scripting in AjaxNetProfessional
Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected cor…
-
Unscored —CVE-2021-45461 EPSS 21%
FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows rem…
-
Unscored —
A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an …
-
High 7.7
An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy H…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
Critical 9.4
An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security …
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ stat_f…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘sn_fil…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘prod_f…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘mac_fi…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7CVE-2021-21924 EPSS 20%
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
Critical 9.8CVE-2021-40417 EPSS 16%
When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decodi…
-
Critical 9.8CVE-2021-40418 EPSS 18%
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assi…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger…
-
High 7.7
An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021)…
-
High 7.7
An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021)…
-
High 7.7
An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021)…
-
High 8.8
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-S…