Archive
December 2021
Vulnerabilities first published in this month (UTC), newest first.
166 results · Clear filters · Feed
-
Critical 9.8CVE-2021-40418 EPSS 18%
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assi…
-
Critical 9.1
A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Vers…
-
Critical 9.8
A stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Mod…
-
Critical 9.8
A stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Mod…
-
Critical 9.1
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.…
-
Critical 9.1
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.…
-
Critical 9.9CVE-2021-21892 EPSS 30%
A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave …
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierW…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierW…
-
Critical 9.9
A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 …
-
Critical 9.1
An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix Premi…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix Premier…
-
Critical 9.1
An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2…
-
Critical 9.9
An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWav…
-
Critical 9.9
An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8…
-
Critical 9.9
An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix Pre…
-
Critical 9.9
A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8…
-
Critical 9.1
Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authent…
-
Critical 9.1
Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authentic…
-
Critical 9.1
A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can mak…
-
Critical 9.1
A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can ma…
-
Critical 9.1
A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can ma…
-
Critical 9.9
An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix Prem…
-
Critical 9.8
Command Injection in node-windows
lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
-
Critical 10.0
An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7…
-
Critical 10.0
An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7…
-
Critical 10.0
Mesa Labs AmegaView command injection
Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.
-
Critical 9.9
Mesa Labs AmegaView Command Injection
Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server.
-
Critical 9.8
Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthentica…
-
Critical —
Remote Code Execution in npm-groovy-lint
Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.
-
Critical 9.6
Command Execution due to unsanitized input
OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_h…
-
Critical 9.8
Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload
Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order t…
-
Critical 9.8
4MOSAn GCB Doctor - Unrestricted Upload of File
4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of se…
-
Critical 9.8
Access Control Bypass
This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after th…
-
Critical 10.0
TCMAN GIM SQL injection vulnerability
TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.
-
Critical 9.6
Host operations allowed in privileged Longhorn managed pods
A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3;…
-
Critical —
Critical vulnerability in log4j may affect generated PEAR projects
### Impact UIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228. ### Patches - The issue has been reso…
-
Critical 9.1
Incorrect Authentication in elabftw
eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as L…
-
Critical 9.8
ThinkPHP5 SQL Injection vulnerability
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
-
Critical 9.8CVE-2021-36888 Scanner template
WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.