Archive
December 2021
Vulnerabilities first published in this month (UTC), newest first.
1,999 results · Feed
-
Unscored —
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the P…
-
Unscored —
An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As …
-
Unscored —
https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected …
-
Medium 6.4
A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local …
-
Medium 6.8
A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmwar…
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.3
Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchat
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
-
Unscored —
Yappli is an application development platform which provides the function to access a requested URL using Custom URL Sc…
-
Unscored —
An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has…
-
Unscored —
An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function.…
-
Unscored —
An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an a…
-
Unscored —
An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attac…
-
Unscored —
An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has l…
-
Unscored —
OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.
-
Unscored —
OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.
-
Unscored —
OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.
-
Unscored —
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
-
Unscored —
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
-
Unscored —
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and imper…
-
Unscored —
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS f…
-
Unscored —
Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_w…
-
High 8.8
User privilege escalation in MinIO
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `REL…
-
Unscored —
An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of t…
-
Unscored —
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink…
-
Unscored —
A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to…
-
Unscored —
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
-
Unscored —
A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force …
-
Medium 6.1
Cross-site Scripting in Netgen Tags Bundle
Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.
-
Unscored —
basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.
-
Unscored —
ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task mo…
-
Unscored —
ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and b…
-
Unscored —
ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But …
-
Medium 5.9
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between Patient Information Center iX (PIC iX) Versions C.02 and C.03 and Efficia CM Series …
-
Medium 6.1
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key
The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.
-
Medium 6.5
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input Validation
Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
-
High 8.1
Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel
The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
-
High 8.1
Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials
IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
-
Critical 9.8
ICSA-21-357-01 Moxa MGate Protocol Gateways
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
-
Medium 6.8
Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to s…
-
Critical 9.8
Gerapy may contain remote code execution vulnerability
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.