35,538 results · Clear filters · Feed
-
Unscored —
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products…
-
Unscored —CVE-2021-25160 Public exploit
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in …
-
Unscored —
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in …
-
Unscored —
A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(…
-
Unscored —
A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(…
-
Unscored —
A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v…
-
Unscored —
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in …
-
Unscored —CVE-2021-26714 Public exploit
The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access rest…
-
Unscored —CVE-2021-29267 Public exploit
Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to …
-
Low 3.3CVE-2021-23358 Public exploit
Arbitrary Code Injection
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
-
Unscored —CVE-2020-7461 Public exploit
In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and …
-
Unscored —CVE-2020-25578 Public exploit
In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and …
-
High 8.1
BuddyPress privilege escalation via REST API
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint.…
-
High 7.4
CA certificate check bypass with X509_V_FLAG_X509_STRICT
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…
-
Unscored —
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attack…
-
Critical 9.9
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authentica…
-
High 7.7CVE-2021-21380 Public exploit
Rating Script Service expose XWiki to SQL injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests wi…
-
High 7.7
Unauthenticated Arbitrary File Access in Jellyfin
Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. S…
-
High 7.1CVE-2021-21401 Public exploit
Invalid free() call in Nanopb
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `…
-
Medium 6.1
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the…
-
High 7.5
XStream can cause a Denial of Service
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such…
-
Medium 5.8
XStream is vulnerable to a Remote Command Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…
-
Unscored —CVE-2021-27308 Public exploit
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to i…
-
Unscored —
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
-
Unscored —CVE-2019-14830 Public exploit
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where th…
-
Unscored —
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the …
-
Unscored —
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the …
-
Unscored —
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, …
-
Unscored —
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
-
Unscored —
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
-
Unscored —CVE-2021-28420 Public exploit
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and t…
-
Unscored —
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which lead…
-
Unscored —CVE-2021-28418 Public exploit
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and…
-
Unscored —CVE-2021-28417 Public exploit
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and …
-
High 8.8
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…
KEV Nov 3, 2021 -
Unscored —CVE-2021-27946 Public exploit
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).
-
Unscored —
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
-
Unscored —CVE-2021-27889 Public exploit
Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
-
Unscored —CVE-2021-27695 Public exploit
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbi…