Archive
December 2021
Vulnerabilities first published in this month (UTC), newest first.
1,999 results · Feed
-
High 7.5
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injectio…
-
High 7.5
Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture f…
-
High 7.5
Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packe…
-
Medium 6.3
Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted ca…
-
High 8.8
Microsoft SharePoint Elevation of Privilege Vulnerability
Microsoft SharePoint Elevation of Privilege Vulnerability
-
Medium 6.8
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
Medium 6.1
ForeScout - SecureConnector Local Service DoS
ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the …
-
Medium 5.4
Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens t…
-
High 7.5
Stored Command Injection
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manip…
-
Unscored —
An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific up…
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.4
Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.1
Emuse - eServices / eNvoice SQL injection
Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive …
-
Medium 6.1
Emuse - eServices / eNvoice Exposure Of Private Personal Information
Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service.
-
High 7.1
Improper Authentication in Qfile
An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfi…
-
High 8.1
Stack Overflow Vulnerability in Surveillance Station
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveil…
-
Medium 5.3
Reflected XSS in Kazoo Server
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of K…
-
Medium 4.9
A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenti…
-
High 7.4
An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote …
-
Medium 5.7
ifme - Improper Access Control leads to admin deactivation
In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
-
Medium 5.4
ifme - Stored Cross-Site Scripting (XSS) in Contacts section
In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
-
Medium 5.4
ifme - Stored Cross-Site Scripting (XSS) in Groups section
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.
-
Medium 5.4
ifme - Stored Cross-Site Scripting (XSS) in Notifications section
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.
-
High 8.8
Changing Information Technology Inc. MOTP(Mobile One Time Password) - SQL Injection
Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication.
-
High 7.3
Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key
Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on t…
-
Medium 6.6
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…
-
Unscored —
SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows atta…
-
Unscored —
The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be config…
-
Unscored —
Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download a…
-
Unscored —
An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020…
-
High 7.8
FATEK Automation WinProladder
FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
-
High 7.8
FATEK Automation WinProladder
FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code.
-
High —
Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy
A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
-
Unscored —CVE-2021-45814 Public exploit
Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel…
-
Unscored —
SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's se…
-
Unscored —
NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can st…
-
Unscored —
A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x be…
-
Unscored —
ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_L…
-
Unscored —
A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated user…
-
Unscored —CVE-2021-45425 Public exploit
Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScri…