Weekly Vulnerabilities Reports > November 1 to 7, 2021

Overview

400 new vulnerabilities reported during this period, including 11 critical vulnerabilities and 66 high severity vulnerabilities. This weekly summary report vulnerabilities in 600 products from 156 vendors including Google, Fortinet, Cisco, Gitlab, and Jenkins. Vulnerabilities are notably categorized as "Cross-site Scripting", "Incorrect Authorization", "Improper Input Validation", "SQL Injection", and "Classic Buffer Overflow".

  • 328 reported vulnerabilities are remotely exploitables.
  • 12 reported vulnerabilities have public exploit available.
  • 135 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 312 reported vulnerabilities are exploitable by an anonymous user.
  • Google has the most reported vulnerabilities, with 62 reported vulnerabilities.
  • Cisco has the most reported critical vulnerabilities, with 2 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

11 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2021-11-05 CVE-2021-42669 Engineers Online Portal Project Unrestricted Upload of File with Dangerous Type vulnerability in Engineers Online Portal Project Engineers Online Portal

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php.

10.0
2021-11-05 CVE-2021-42237 Sitecore Deserialization of Untrusted Data vulnerability in Sitecore Experience Platform

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine.

10.0
2021-11-04 CVE-2021-40119 Cisco Use of Hard-coded Credentials vulnerability in Cisco Policy Suite

A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user.

10.0
2021-11-03 CVE-2021-43130 Customer Relationship Management System Project SQL Injection vulnerability in Customer Relationship Management System Project Customer Relationship Management System 1.0

An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php.

10.0
2021-11-01 CVE-2021-29212 HP Path Traversal vulnerability in HP ILO Amplifier Pack

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95.

10.0
2021-11-01 CVE-2021-3705 HP Incorrect Authorization vulnerability in HP products

Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfigure, reset the device.

10.0
2021-11-04 CVE-2021-42057 Obsidian Code Injection vulnerability in Obsidian Dataview

Obsidian Dataview through 0.4.12-hotfix1 allows eval injection.

9.3
2021-11-01 CVE-2021-40348 Uyuni Project
Spacewalk Project
Code Injection vulnerability in multiple products

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection.

9.3
2021-11-07 CVE-2021-43413 GNU Unspecified vulnerability in GNU Hurd

An issue was discovered in GNU Hurd before 0.9 20210404-9.

9.0
2021-11-04 CVE-2021-40120 Cisco Improper Input Validation vulnerability in Cisco Application Extension Platform and IOS XR

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system and execute them using root-level privileges.

9.0
2021-11-01 CVE-2021-25877 Youphptube Incorrect Permission Assignment for Critical Resource vulnerability in Youphptube

AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write.

9.0

66 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2021-11-07 CVE-2021-43411 GNU Incorrect Authorization vulnerability in GNU Hurd

An issue was discovered in GNU Hurd before 0.9 20210404-9.

8.5
2021-11-04 CVE-2020-25366 Dlink Missing Authorization vulnerability in Dlink Dir-823G Firmware 1.02B05

An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.

8.5
2021-11-04 CVE-2021-34594 Beckhoff Path Traversal vulnerability in Beckhoff Tf6100 Firmware and Ts6100 Firmware

TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.

8.5
2021-11-07 CVE-2021-37471 Cradlepoint Resource Exhaustion vulnerability in Cradlepoint Ibr600 Firmware, Ibr600C Firmware and Ibr900 Firmware

Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.

7.8
2021-11-03 CVE-2021-35053 Kaspersky Unspecified vulnerability in Kaspersky Endpoint Security 11.1.0

Possible system denial of service in case of arbitrary changing Firefox browser parameters.

7.8
2021-11-01 CVE-2021-3704 HP Resource Exhaustion vulnerability in HP products

Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow a Denial of Service on the device.

7.8
2021-11-05 CVE-2020-22223 Phpjabbers SQL Injection vulnerability in PHPjabbers Fundraising Script 1.0

Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function.

7.5
2021-11-05 CVE-2020-22225 Phpjabbers SQL Injection vulnerability in PHPjabbers Fundraising Script 1.0

Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function.

7.5
2021-11-05 CVE-2020-22226 Phpjabbers SQL Injection vulnerability in PHPjabbers Fundraising Script 1.0

Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function.

7.5
2021-11-05 CVE-2021-35368 Owasp Incorrect Authorization vulnerability in Owasp Modsecurity Core Rule SET

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.

7.5
2021-11-05 CVE-2021-42837 Talend Incorrect Authorization vulnerability in Talend Data Catalog

An issue was discovered in Talend Data Catalog before 7.3-20210930.

7.5
2021-11-05 CVE-2021-42543 Azeotech Use of Inherently Dangerous Function vulnerability in Azeotech Daqfactory

The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.

7.5
2021-11-05 CVE-2021-42665 Engineers Online Portal Project SQL Injection vulnerability in Engineers Online Portal Project Engineers Online Portal 1.0

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.

7.5
2021-11-05 CVE-2021-42667 Online Event Booking AND Reservation System Project SQL Injection vulnerability in Online Event Booking and Reservation System Project Online Event Booking and Reservation System 2.3.0

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views.

7.5
2021-11-05 CVE-2021-42668 Engineers Online Portal Project SQL Injection vulnerability in Engineers Online Portal Project Engineers Online Portal

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page..

7.5
2021-11-05 CVE-2021-42670 Engineers Online Portal Project SQL Injection vulnerability in Engineers Online Portal Project Engineers Online Portal

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page.

7.5
2021-11-05 CVE-2021-25508 Samsung Improper Privilege Management vulnerability in Samsung Smartthings

Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.

7.5
2021-11-04 CVE-2021-21690 Jenkins Protection Mechanism Failure vulnerability in Jenkins

Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

7.5
2021-11-04 CVE-2021-21691 Jenkins Incorrect Authorization vulnerability in Jenkins

Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

7.5
2021-11-04 CVE-2021-21692 Jenkins Incorrect Authorization vulnerability in Jenkins

FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.

7.5
2021-11-04 CVE-2021-21693 Jenkins Improper Authorization vulnerability in Jenkins

When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

7.5
2021-11-04 CVE-2021-21694 Jenkins Missing Authorization vulnerability in Jenkins

FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

7.5
2021-11-04 CVE-2021-21696 Jenkins Protection Mechanism Failure vulnerability in Jenkins

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant.

7.5
2021-11-04 CVE-2021-34795 Cisco Use of Hard-coded Credentials vulnerability in Cisco products

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

7.5
2021-11-04 CVE-2021-40113 Cisco Command Injection vulnerability in Cisco products

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

7.5
2021-11-04 CVE-2020-25368 Dlink Command Injection vulnerability in Dlink Dir-823G Firmware 1.02B05

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05.

7.5
2021-11-04 CVE-2020-25367 Dlink Command Injection vulnerability in Dlink Dir-823G Firmware 1.0.2B05

A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05.

7.5
2021-11-03 CVE-2021-41492 Simple Cashiering System Project SQL Injection vulnerability in Simple Cashiering System Project Simple Cashiering System 1.0

Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page in cashiering.

7.5
2021-11-03 CVE-2021-43140 Simple Subscription Website Project SQL Injection vulnerability in Simple Subscription Website Project Simple Subscription Website 1.0

SQL Injection vulnerability exists in Sourcecodester.

7.5
2021-11-03 CVE-2020-18261 Ed01 CMS Project Unrestricted Upload of File with Dangerous Type vulnerability in Ed01-Cms Project Ed01-Cms 1.0

An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands.

7.5
2021-11-03 CVE-2020-18262 Ed01 CMS Project SQL Injection vulnerability in Ed01-Cms Project Ed01-Cms 1.0

ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter.

7.5
2021-11-03 CVE-2021-23509 Json PTR Project Type Confusion vulnerability in Json-Ptr Project Json-Ptr

This affects the package json-ptr before 3.0.0.

7.5
2021-11-03 CVE-2021-23624 Dotty Project Type Confusion vulnerability in Dotty Project Dotty

This affects the package dotty before 0.1.2.

7.5
2021-11-03 CVE-2021-23807 Jsonpointer Project Type Confusion vulnerability in Jsonpointer Project Jsonpointer

This affects the package jsonpointer before 5.0.0.

7.5
2021-11-03 CVE-2021-23820 Jsonpointer Project Type Confusion vulnerability in Jsonpointer Project Jsonpointer

This affects all versions of package json-pointer.

7.5
2021-11-03 CVE-2020-23679 Linux Network Project Classic Buffer Overflow vulnerability in Linux Network Project Linux Network Project 1.0

Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field.

7.5
2021-11-03 CVE-2020-24000 Eyoucms SQL Injection vulnerability in Eyoucms 1.4.7

SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php.

7.5
2021-11-03 CVE-2020-24743 Zohocorp Unspecified vulnerability in Zohocorp Manageengine Applications Manager

An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter.

7.5
2021-11-03 CVE-2021-43082 Apache Classic Buffer Overflow vulnerability in Apache Traffic Server

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory.

7.5
2021-11-03 CVE-2021-40849 Mahara Insufficient Session Expiration vulnerability in Mahara

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.

7.5
2021-11-03 CVE-2020-5955 Insyde Improper Privilege Management vulnerability in Insyde Insydeh2O Uefi Bios

An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets.

7.5
2021-11-03 CVE-2021-39238 HP Classic Buffer Overflow vulnerability in HP Futuresmart 3, Futuresmart 4 and Futuresmart 5

Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buffer overflow.

7.5
2021-11-03 CVE-2021-20700 NEC Classic Buffer Overflow vulnerability in NEC Clusterpro X and Expresscluster X

Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.

7.5
2021-11-03 CVE-2021-20701 NEC Classic Buffer Overflow vulnerability in NEC Clusterpro X and Expresscluster X

Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.

7.5
2021-11-03 CVE-2021-20702 NEC Classic Buffer Overflow vulnerability in NEC Clusterpro X and Expresscluster X

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.

7.5
2021-11-03 CVE-2021-20703 NEC Classic Buffer Overflow vulnerability in NEC Clusterpro X and Expresscluster X

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.

7.5
2021-11-03 CVE-2021-20704 NEC Classic Buffer Overflow vulnerability in NEC Clusterpro X and Expresscluster X

Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.

7.5
2021-11-03 CVE-2021-41036 Eclipse Out-of-bounds Write vulnerability in Eclipse Paho Mqtt C/C++ Client

In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket.

7.5
2021-11-02 CVE-2021-43267 Linux
Fedoraproject
Netapp
Improper Input Validation vulnerability in multiple products

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.

7.5
2021-11-02 CVE-2021-36186 Fortinet Out-of-bounds Write vulnerability in Fortinet Fortiweb

A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests

7.5
2021-11-02 CVE-2020-18440 Phpok Classic Buffer Overflow vulnerability in PHPok 5.1

Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.

7.5
2021-11-02 CVE-2020-23685 Vtimecn SQL Injection vulnerability in Vtimecn 188Jianzhan 2.1.0

SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to login.php.

7.5
2021-11-02 CVE-2021-41232 Thunderdome Injection vulnerability in Thunderdome Planning Poker

Thunderdome is an open source agile planning poker tool in the theme of Battling for points.

7.5
2021-11-02 CVE-2021-36560 Phone Shop Sales Management System Project Improper Authentication vulnerability in Phone Shop Sales Management System Project Phone Shop Sales Management System 1.0

Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin.

7.5
2021-11-01 CVE-2021-20136 Zohocorp Incorrect Authorization vulnerability in Zohocorp Manageengine Log360

ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite.

7.5
2021-11-01 CVE-2021-26739 Doyocms Project SQL Injection vulnerability in Doyocms Project Doyocms 2.3

SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.

7.5
2021-11-01 CVE-2021-26740 Doyocms Project Unrestricted Upload of File with Dangerous Type vulnerability in Doyocms Project Doyocms 2.3

Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.

7.5
2021-11-07 CVE-2021-43412 GNU Use After Free vulnerability in GNU Hurd

An issue was discovered in GNU Hurd before 0.9 20210404-9.

7.2
2021-11-05 CVE-2021-39913 Gitlab Improper Privilege Management vulnerability in Gitlab

Accidental logging of system root password in the migration log in all versions of GitLab CE/EE allows an attacker with local file system access to obtain system root-level privileges

7.2
2021-11-04 CVE-2021-40124 Cisco Improper Privilege Management vulnerability in Cisco Anyconnect Secure Mobility Client

A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to escalate privileges on an affected device.

7.2
2021-11-02 CVE-2021-36183 Fortinet Incorrect Authorization vulnerability in Fortinet Forticlient

An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for Forticlient updates.

7.2
2021-11-02 CVE-2021-36922 Realtek Improper Privilege Management vulnerability in Realtek Rtsupx USB Utility Driver

RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.

7.2
2021-11-02 CVE-2021-36923 Realtek Improper Privilege Management vulnerability in Realtek Rtsupx USB Utility Driver

RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.

7.2
2021-11-02 CVE-2021-36924 Realtek Resource Exhaustion vulnerability in Realtek Rtsupx USB Utility Driver

RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device.

7.2
2021-11-02 CVE-2021-36925 Realtek Unspecified vulnerability in Realtek Rtsupx USB Utility Driver

RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.

7.2
2021-11-01 CVE-2021-29213 HPE Unspecified vulnerability in HPE products

A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant MicroServer Gen10 Plus server's system ROMs prior to version 2.52.

7.2

241 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2021-11-07 CVE-2021-43414 GNU Incorrect Authorization vulnerability in GNU Hurd

An issue was discovered in GNU Hurd before 0.9 20210404-9.

6.9
2021-11-05 CVE-2020-23565 Irfanview Unspecified vulnerability in Irfanview 4.53

Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file.

6.8
2021-11-05 CVE-2021-42698 Azeotech Deserialization of Untrusted Data vulnerability in Azeotech Daqfactory

Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory.

6.8
2021-11-05 CVE-2021-3927 VIM
Fedoraproject
Heap-based Buffer Overflow vulnerability in multiple products

vim is vulnerable to Heap-based Buffer Overflow

6.8
2021-11-05 CVE-2021-25505 Samsung Improper Authentication vulnerability in Samsung Pass

Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.

6.8
2021-11-04 CVE-2021-21695 Jenkins Missing Authorization vulnerability in Jenkins

FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

6.8
2021-11-04 CVE-2021-34739 Cisco Insufficient Session Expiration vulnerability in Cisco products

A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device.

6.8
2021-11-04 CVE-2021-34597 Phoenixcontact Improper Input Validation vulnerability in Phoenixcontact PC Worx and PC Worx Express

Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.

6.8
2021-11-03 CVE-2021-42772 Broadcom Classic Buffer Overflow vulnerability in Broadcom Emulex HBA Manager and ONE Command Manager

Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote GetDumpFile command that could allow a user to attempt various attacks.

6.8
2021-11-03 CVE-2021-38424 Deltaww Improper Neutralization of Formula Elements in a CSV File vulnerability in Deltaww Dialink 1.2.4.0

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data.

6.8
2021-11-03 CVE-2020-20982 Wdja Cross-site Scripting vulnerability in Wdja CMS 1.5.1

Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.

6.8
2021-11-03 CVE-2020-23680 Text2Pdf Project Unspecified vulnerability in Text2Pdf Project Text2Pdf 1.1

An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibly other undisclosed impacts.

6.8
2021-11-03 CVE-2021-38161 Apache Improper Authentication vulnerability in Apache Traffic Server

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks.

6.8
2021-11-03 CVE-2021-40848 Mahara Improper Neutralization of Formula Elements in a CSV File vulnerability in Mahara

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.

6.8
2021-11-03 CVE-2021-38493 Mozilla Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13.

6.8
2021-11-03 CVE-2021-38494 Mozilla Unspecified vulnerability in Mozilla Firefox

Mozilla developers reported memory safety bugs present in Firefox 91.

6.8
2021-11-03 CVE-2021-38495 Mozilla Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox ESR

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0.

6.8
2021-11-03 CVE-2021-38496 Mozilla Use After Free vulnerability in Mozilla Firefox

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash.

6.8
2021-11-03 CVE-2021-38499 Mozilla Unspecified vulnerability in Mozilla Firefox

Mozilla developers reported memory safety bugs present in Firefox 92.

6.8
2021-11-03 CVE-2021-38500 Mozilla Unspecified vulnerability in Mozilla Firefox

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.

6.8
2021-11-03 CVE-2021-38501 Mozilla Unspecified vulnerability in Mozilla Firefox

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.

6.8
2021-11-02 CVE-2018-6122 Google Type Confusion vulnerability in Google Chrome

Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2020-6492 Google Use After Free vulnerability in Google Chrome

Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37981 Google Out-of-bounds Write vulnerability in Google Chrome

Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37982 Google Use After Free vulnerability in Google Chrome

Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37983 Google Use After Free vulnerability in Google Chrome

Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37984 Google Out-of-bounds Write vulnerability in Google Chrome

Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37985 Google Use After Free vulnerability in Google Chrome

Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to debugger to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37986 Google Out-of-bounds Write vulnerability in Google Chrome

Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37987 Google Use After Free vulnerability in Google Chrome

Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37988 Google Use After Free vulnerability in Google Chrome

Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37992 Google Out-of-bounds Read vulnerability in Google Chrome

Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37993 Google Use After Free vulnerability in Google Chrome

Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37977 Google
Fedoraproject
Use After Free vulnerability in multiple products

Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37978 Google
Fedoraproject
Out-of-bounds Write vulnerability in multiple products

Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2021-37979 Google
Fedoraproject
Out-of-bounds Write vulnerability in multiple products

heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a crafted HTML page.

6.8
2021-11-02 CVE-2020-23686 Ayacms Project Cross-Site Request Forgery (CSRF) vulnerability in Ayacms Project Ayacms 3.1.2

Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts.

6.8
2021-11-02 CVE-2020-23718 Zibbs Project Cross-site Scripting vulnerability in Zibbs Project Zibbs 1.0

Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.

6.8
2021-11-02 CVE-2020-23719 Zibbs Project Cross-site Scripting vulnerability in Zibbs Project Zibbs 1.0

Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the bbsmeta parameter.

6.8
2021-11-02 CVE-2020-23754 PHP Fusion Cross-site Scripting vulnerability in PHP-Fusion PHPfusion 9.03.50

Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature.

6.8
2021-11-02 CVE-2021-29888 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM Infosphere Information Server 11.7

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

6.8
2021-11-02 CVE-2021-36794 Siren Unspecified vulnerability in Siren Investigate

In Siren Investigate before 11.1.4, when enabling the cluster feature of the Siren Alert application, TLS verifications are disabled globally in the Siren Investigate main process.

6.8
2021-11-01 CVE-2021-24809 Wordplus Cross-Site Request Forgery (CSRF) vulnerability in Wordplus Better Messages

The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread.

6.8
2021-11-05 CVE-2021-41230 Pomerium Incorrect Authorization vulnerability in Pomerium

Pomerium is an open source identity-aware access proxy.

6.5
2021-11-05 CVE-2021-43404 Fusionpbx Improper Input Validation vulnerability in Fusionpbx

An issue was discovered in FusionPBX before 4.5.30.

6.5
2021-11-05 CVE-2021-43405 Fusionpbx Improper Input Validation vulnerability in Fusionpbx

An issue was discovered in FusionPBX before 4.5.30.

6.5
2021-11-05 CVE-2021-43406 Fusionpbx Improper Input Validation vulnerability in Fusionpbx

An issue was discovered in FusionPBX before 4.5.30.

6.5
2021-11-05 CVE-2021-42666 Engineers Online Portal Project SQL Injection vulnerability in Engineers Online Portal Project Engineers Online Portal 1.0

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.

6.5
2021-11-04 CVE-2021-43281 Mybb Code Injection vulnerability in Mybb

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission.

6.5
2021-11-03 CVE-2021-43338 Ericsson SQL Injection vulnerability in Ericsson Network Location MPS Gmpc21

In Ericsson Network Location MPS GMPC21, it is possible to creates a new admin user with a SQL Query for file_name in the export functionality.

6.5
2021-11-03 CVE-2021-43339 Ericsson Command Injection vulnerability in Ericsson Network Location

In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality.

6.5
2021-11-03 CVE-2021-26786 Playtuber Project Unspecified vulnerability in Playtuber Project Playtuber

An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the config.php.

6.5
2021-11-02 CVE-2021-36185 Fortinet OS Command Injection vulnerability in Fortinet Fortiwlm

A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

6.5
2021-11-01 CVE-2021-41187 Dhis2 SQL Injection vulnerability in Dhis2 Dhis 2

DHIS 2 is an information system for data capture, management, validation, analytics and visualization.

6.5
2021-11-01 CVE-2021-31849 Mcafee SQL Injection vulnerability in Mcafee Data Loss Prevention Endpoint 11.6.0/11.6.100.41

SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension.

6.5
2021-11-01 CVE-2021-38847 S Cart Unrestricted Upload of File with Dangerous Type vulnerability in S-Cart

S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel.

6.5
2021-11-01 CVE-2021-24717 Automatorwp Incorrect Authorization vulnerability in Automatorwp

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.

6.5
2021-11-05 CVE-2021-42359 Legalweb Missing Authorization vulnerability in Legalweb WP Dsgvo Tools 3.1.21/3.1.22/3.1.23

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests.

6.4
2021-11-04 CVE-2021-43400 Bluez Use After Free vulnerability in Bluez 5.61

An issue was discovered in gatt-database.c in BlueZ 5.61.

6.4
2021-11-04 CVE-2021-21685 Jenkins Missing Authorization vulnerability in Jenkins

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.

6.4
2021-11-04 CVE-2021-21687 Jenkins Missing Authorization vulnerability in Jenkins

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.

6.4
2021-11-04 CVE-2021-21689 Jenkins Missing Authorization vulnerability in Jenkins

FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

6.4
2021-11-04 CVE-2021-21697 Jenkins Incomplete Blacklist vulnerability in Jenkins

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

6.4
2021-11-02 CVE-2020-18439 Phpok Unspecified vulnerability in PHPok 5.1

An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get a shell.

6.4
2021-11-02 CVE-2021-36172 Fortinet XXE vulnerability in Fortinet Fortiportal

An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.

6.4
2021-11-02 CVE-2021-38948 IBM XML Injection (aka Blind XPath Injection) vulnerability in IBM Infosphere Information Server 11.7

IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

6.4
2021-11-02 CVE-2021-25973 Publify Project Incorrect Authorization vulnerability in Publify Project Publify

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control.

6.4
2021-11-01 CVE-2021-39341 Optinmonster Cleartext Transmission of Sensitive Information vulnerability in Optinmonster

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed.

6.4
2021-11-01 CVE-2021-27644 Apache SQL Injection vulnerability in Apache Dolphinscheduler

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center.

6.0
2021-11-01 CVE-2020-36503 Connections PRO Improper Neutralization of Formula Elements in a CSV File vulnerability in Connections-Pro Connections Business Directory

The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue

6.0
2021-11-04 CVE-2021-21686 Jenkins Link Following vulnerability in Jenkins

File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

5.8
2021-11-04 CVE-2021-1500 Cisco Open Redirect vulnerability in Cisco Collaboration Meeting Rooms and Webex Video Mesh

A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.

5.8
2021-11-03 CVE-2021-22960 Llhttp HTTP Request Smuggling vulnerability in Llhttp

The parse function in llhttp < 2.1.4 and < 6.0.6.

5.8
2021-11-03 CVE-2020-23109 Struktur Classic Buffer Overflow vulnerability in Struktur Libheif 1.6.2

Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

5.8
2021-11-03 CVE-2021-29991 Mozilla HTTP Request Smuggling vulnerability in Mozilla Firefox

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers.

5.8
2021-11-03 CVE-2021-29993 Mozilla Unspecified vulnerability in Mozilla Firefox

Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs.

5.8
2021-11-02 CVE-2021-29738 IBM Server-Side Request Forgery (SSRF) vulnerability in IBM Infosphere Information Server 11.7

IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF).

5.5
2021-11-01 CVE-2021-39333 Hashthemes Improper Access Control vulnerability in Hashthemes Demo Importer

The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.

5.5
2021-11-02 CVE-2021-37991 Google Race Condition vulnerability in Google Chrome

Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

5.1
2021-11-01 CVE-2021-42574 Unicode
Fedoraproject
Code Injection vulnerability in multiple products

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.

5.1
2021-11-01 CVE-2021-42694 Unicode Code Injection vulnerability in Unicode

An issue was discovered in the character definitions of the Unicode Specification through 14.0.

5.1
2021-11-05 CVE-2021-3924 Getgrav Path Traversal vulnerability in Getgrav Grav

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

5.0
2021-11-05 CVE-2021-42671 Engineers Online Portal Project Incorrect Authorization vulnerability in Engineers Online Portal Project Engineers Online Portal

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads.

5.0
2021-11-05 CVE-2021-39897 Gitlab Improper Preservation of Permissions vulnerability in Gitlab

Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred

5.0
2021-11-05 CVE-2021-39898 Gitlab Exposure of Resource to Wrong Sphere vulnerability in Gitlab

In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.

5.0
2021-11-05 CVE-2021-39907 Gitlab Allocation of Resources Without Limits or Throttling vulnerability in Gitlab

A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7.

5.0
2021-11-05 CVE-2021-39912 Gitlab Allocation of Resources Without Limits or Throttling vulnerability in Gitlab

A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7.

5.0
2021-11-04 CVE-2021-39914 Gitlab Allocation of Resources Without Limits or Throttling vulnerability in Gitlab

A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user

5.0
2021-11-04 CVE-2021-43398 Cryptopp Information Exposure Through Discrepancy vulnerability in Cryptopp Crypto++

** DISPUTED ** Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey().

5.0
2021-11-04 CVE-2021-43396 GNU Unspecified vulnerability in GNU Glibc 2.34

** DISPUTED ** In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset.

5.0
2021-11-04 CVE-2021-41247 Jupyter Insufficient Session Expiration vulnerability in Jupyter Jupyterhub

JupyterHub is an open source multi-user server for Jupyter notebooks.

5.0
2021-11-04 CVE-2021-21688 Jenkins Missing Authorization vulnerability in Jenkins

The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).

5.0
2021-11-04 CVE-2021-21698 Jenkins Path Traversal vulnerability in Jenkins Subversion

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.

5.0
2021-11-04 CVE-2021-34741 Cisco Improper Input Validation vulnerability in Cisco Asyncos

A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device.

5.0
2021-11-04 CVE-2021-40112 Cisco Improper Input Validation vulnerability in Cisco products

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

5.0
2021-11-04 CVE-2021-40127 Cisco Improper Input Validation vulnerability in Cisco products

A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote attacker to render the web-based management interface unusable, resulting in a denial of service (DoS) condition.

5.0
2021-11-04 CVE-2021-40128 Cisco Improper Input Validation vulnerability in Cisco Webex Meetings

A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain.

5.0
2021-11-03 CVE-2021-33800 Alibaba Path Traversal vulnerability in Alibaba Druid 1.2.3

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.

5.0
2021-11-03 CVE-2020-18263 PHP CMS Project SQL Injection vulnerability in PHP-Cms Project PHP-Cms 1.0

PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter.

5.0
2021-11-03 CVE-2021-37147 Apache Improper Input Validation vulnerability in Apache Traffic Server

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests.

5.0
2021-11-03 CVE-2021-37148 Apache Improper Input Validation vulnerability in Apache Traffic Server

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests.

5.0
2021-11-03 CVE-2021-37149 Apache Improper Input Validation vulnerability in Apache Traffic Server

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests.

5.0
2021-11-03 CVE-2021-41585 Apache Improper Input Validation vulnerability in Apache Traffic Server

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections.

5.0
2021-11-03 CVE-2021-33209 Fimer Improper Restriction of Excessive Authentication Attempts vulnerability in Fimer Aurora Vision

An issue was discovered in Fimer Aurora Vision before 2.97.10.

5.0
2021-11-03 CVE-2021-41312 Atlassian Improper Authentication vulnerability in Atlassian Data Center and Jira

Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors endpoint.

5.0
2021-11-03 CVE-2021-38498 Mozilla Use After Free vulnerability in Mozilla Firefox

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash.

5.0
2021-11-03 CVE-2021-20705 NEC Improper Input Validation vulnerability in NEC Clusterpro X and Expresscluster X

Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote file upload via network.

5.0
2021-11-03 CVE-2021-20706 NEC Improper Input Validation vulnerability in NEC Clusterpro X and Expresscluster X

Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote file upload via network.

5.0
2021-11-03 CVE-2021-20707 NEC Improper Input Validation vulnerability in NEC Clusterpro X and Expresscluster X

Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to read files upload via network..

5.0
2021-11-02 CVE-2021-43270 Datalust Unspecified vulnerability in Datalust Seq.App.Emailplus 3.1.0

Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended.

5.0
2021-11-02 CVE-2021-42697 Akka Out-of-bounds Write vulnerability in Akka Http Server

Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

5.0
2021-11-02 CVE-2021-36174 Fortinet Allocation of Resources Without Limits or Throttling vulnerability in Fortinet Fortiportal

A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service attack via specially crafted license blobs.

5.0
2021-11-02 CVE-2021-36187 Fortinet Resource Exhaustion vulnerability in Fortinet Fortiweb

A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests

5.0
2021-11-02 CVE-2020-18438 Phpok Path Traversal vulnerability in PHPok 5.1

Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.

5.0
2021-11-02 CVE-2020-20657 Libiec Iccp MOD Project Classic Buffer Overflow vulnerability in Libiec Iccp MOD Project Libiec Iccp MOD 1.5

Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while trying to connect.

5.0
2021-11-02 CVE-2020-20658 Libiec Iccp MOD Project Classic Buffer Overflow vulnerability in Libiec Iccp MOD Project Libiec Iccp MOD 1.5

Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexpectiedly large space.

5.0
2021-11-02 CVE-2020-21572 Gilcc Project Classic Buffer Overflow vulnerability in Gilcc Project Gilcc

Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, allows attackers to cause a denial of service.

5.0
2021-11-02 CVE-2020-21574 C Http Project Classic Buffer Overflow vulnerability in C-Http Project C-Http 0.1.0

Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is passed to the delimitedread function.

5.0
2021-11-02 CVE-2021-41238 Hangfire Missing Authorization vulnerability in Hangfire 1.7.25

Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications.

5.0
2021-11-02 CVE-2021-29737 IBM Improper Certificate Validation vulnerability in IBM Infosphere Information Server 11.7

IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server certificate.

5.0
2021-11-02 CVE-2021-29875 IBM Unspecified vulnerability in IBM Infosphere Information Server 11.7

IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access vulnerability.

5.0
2021-11-02 CVE-2021-37842 Couchbase Cleartext Storage of Sensitive Information vulnerability in Couchbase Server 7.0.0/7.0.1

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information.

5.0
2021-11-02 CVE-2021-42763 Couchbase Cleartext Storage of Sensitive Information vulnerability in Couchbase Server

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext.

5.0
2021-11-02 CVE-2021-27722 Nsasoft Classic Buffer Overflow vulnerability in Nsasoft Spotauditor 5.3.5

An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5.

5.0
2021-11-02 CVE-2021-33593 Navercorp Unspecified vulnerability in Navercorp Whale

Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.

5.0
2021-11-02 CVE-2021-3765 Validator Project Unspecified vulnerability in Validator Project Validator

validator.js is vulnerable to Inefficient Regular Expression Complexity

5.0
2021-11-01 CVE-2020-28702 Pybbscms Project SQL Injection vulnerability in Pybbscms Project Pybbmscms 5.2.1

A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.

5.0
2021-11-01 CVE-2021-27005 Netapp Resource Exhaustion vulnerability in Netapp Ontap System Manager 9.7/9.8/9.9.12

Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow a remote attacker to cause a crash of the httpd server.

5.0
2021-11-01 CVE-2021-25874 Youphptube SQL Injection vulnerability in Youphptube

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.

5.0
2021-11-01 CVE-2021-42557 Jeedom Insufficiently Protected Credentials vulnerability in Jeedom 4.0.38

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.

5.0
2021-11-01 CVE-2015-20067 WP Attachment Export Project Missing Authorization vulnerability in WP Attachment Export Project WP Attachment Export

The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress

5.0
2021-11-01 CVE-2018-25019 Learndash Missing Authorization vulnerability in Learndash

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server

5.0
2021-11-01 CVE-2021-24685 Flat Preloader Project Cross-Site Request Forgery (CSRF) vulnerability in Flat Preloader Project Flat Preloader

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)

5.0
2021-11-01 CVE-2021-24757 Stylishpricelist Incorrect Authorization vulnerability in Stylishpricelist Stylish Price List

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.

5.0
2021-11-01 CVE-2021-20838 Antennahouse XXE vulnerability in Antennahouse Office Server Document Converter

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially crafted XML document.

5.0
2021-11-03 CVE-2020-27820 Linux
Fedoraproject
Use After Free vulnerability in multiple products

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).

4.7
2021-11-05 CVE-2021-41216 Google Out-of-bounds Write vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41220 Google Use After Free vulnerability in Google Tensorflow 2.6.0/2.7.0

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41221 Google Out-of-bounds Write vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41228 Google Code Injection vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41206 Google Improper Validation of Integrity Check Value vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41208 Google NULL Pointer Dereference vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41203 Google Insufficient Verification of Data Authenticity vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41214 Google Access of Uninitialized Pointer vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41219 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-41201 Google Access of Uninitialized Pointer vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.6
2021-11-05 CVE-2021-3928 VIM
Fedoraproject
Use of Uninitialized Variable vulnerability in multiple products

vim is vulnerable to Use of Uninitialized Variable

4.6
2021-11-05 CVE-2021-25503 Google Improper Input Validation vulnerability in Google Android

Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution.

4.6
2021-11-04 CVE-2021-42624 Miniftpd Project Classic Buffer Overflow vulnerability in Miniftpd Project Miniftpd

A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable, where a crafted payload can be sent to the affected function.

4.6
2021-11-03 CVE-2020-28416 HP Unspecified vulnerability in HP products

HP has identified a security vulnerability with the I.R.I.S.

4.6
2021-11-03 CVE-2020-6931 HP Improper Privilege Management vulnerability in HP Print and Scan Doctor

HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege.

4.6
2021-11-03 CVE-2021-38420 Deltaww Incorrect Default Permissions vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files.

4.6
2021-11-03 CVE-2021-38422 Deltaww Cleartext Storage of Sensitive Information vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges.

4.6
2021-11-03 CVE-2021-36697 Artica Injection vulnerability in Artica Pandora FMS

With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component.

4.6
2021-11-03 CVE-2021-20135 Tenable Improper Privilege Management vulnerability in Tenable Nessus

Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host.

4.6
2021-11-02 CVE-2017-5123 Linux Improper Input Validation vulnerability in Linux Kernel

Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.

4.6
2021-11-02 CVE-2021-43266 Mahara Command Injection vulnerability in Mahara

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name.

4.6
2021-11-02 CVE-2021-41022 Fortinet Improper Privilege Management vulnerability in Fortinet Fortisiem

A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershell scripts

4.6
2021-11-01 CVE-2021-3440 HP Improper Privilege Management vulnerability in HP Smart

HP Print and Scan Doctor, an application within the HP Smart App for Windows, is potentially vulnerable to local elevation of privilege.

4.6
2021-11-03 CVE-2021-38416 Deltaww Uncontrolled Search Path Element vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.

4.4
2021-11-05 CVE-2020-22222 Phpjabbers Cross-site Scripting vulnerability in PHPjabbers Fundraising Script 1.0

Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss function.

4.3
2021-11-05 CVE-2020-22224 Phpjabbers Cross-site Scripting vulnerability in PHPjabbers Fundraising Script 1.0

Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview function.

4.3
2021-11-05 CVE-2021-41213 Google Improper Locking vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

4.3
2021-11-05 CVE-2021-3774 Meross Missing Encryption of Sensitive Data vulnerability in Meross Mss550X Firmware

Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in its initial setup.

4.3
2021-11-05 CVE-2021-29753 IBM Cleartext Transmission of Sensitive Information vulnerability in IBM products

IBM Business Automation Workflow 18.

4.3
2021-11-05 CVE-2020-23566 Irfanview Infinite Loop vulnerability in Irfanview 4.53

Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.

4.3
2021-11-05 CVE-2020-23567 Irfanview Divide By Zero vulnerability in Irfanview 4.53

Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file.

4.3
2021-11-05 CVE-2021-39413 Seopanel Cross-site Scripting vulnerability in Seopanel SEO Panel 4.8.0

Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, and (j) reports.php; the (2) from_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) reports.php; the (3) order_col parameter in (a) analytics.php, (b) review.php, (c) social_media.php, and (d) webmaster-tools.php; and the (4) pageno parameter in (a) alerts.php, (b) log.php, (c) keywords.php, (d) proxy.php, (e) searchengine.php, and (f) siteauditor.php.

4.3
2021-11-05 CVE-2021-39416 Remoteclinic Cross-site Scripting vulnerability in Remoteclinic Remote Clinic 2.0

Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters.

4.3
2021-11-05 CVE-2021-42699 Azeotech Cleartext Transmission of Sensitive Information vulnerability in Azeotech Daqfactory

The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP.

4.3
2021-11-05 CVE-2021-39411 Hospital Management System Project Cross-site Scripting vulnerability in Hospital Management System Project Hospital Management System 4.0

Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.

4.3
2021-11-05 CVE-2021-39412 Shopping Portal Project Cross-site Scripting vulnerability in Shopping Portal Project Shopping Portal 3.1

Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php, (b) server_side/scripts/jsonp.php, and (c) scripts/objects_jsonp.php, the (2) value parameter in examples_support/editable_ajax.php, and the (3) PHP_SELF parameter in captcha/index.php.

4.3
2021-11-05 CVE-2021-42663 Online Event Booking AND Reservation System Project Injection vulnerability in Online Event Booking and Reservation System Project Online Event Booking and Reservation System 2.3.0

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php.

4.3
2021-11-05 CVE-2021-39906 Gitlab Cross-site Scripting vulnerability in Gitlab

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

4.3
2021-11-04 CVE-2020-21139 EC Cloud E Commerce System Project Cross-Site Request Forgery (CSRF) vulnerability in EC Cloud E-Commerce System Project EC Cloud E-Commerce System 1.3

EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admin.html?do=user&act=add.

4.3
2021-11-04 CVE-2021-34773 Cisco Cross-Site Request Forgery (CSRF) vulnerability in Cisco products

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device.

4.3
2021-11-04 CVE-2021-40115 Cisco Cross-site Scripting vulnerability in Cisco Collaboration Meeting Rooms and Webex Video Mesh

A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

4.3
2021-11-03 CVE-2021-38418 Deltaww Cleartext Transmission of Sensitive Information vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.

4.3
2021-11-03 CVE-2021-43141 Simple Subscription Website Project Cross-site Scripting vulnerability in Simple Subscription Website Project Simple Subscription Website 1.0

Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.

4.3
2021-11-03 CVE-2020-18259 Ed01 CMS Project Cross-site Scripting vulnerability in Ed01-Cms Project Ed01-Cms 1.0

ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php.

4.3
2021-11-03 CVE-2021-23472 Bootstrap Table Project Type Confusion vulnerability in Bootstrap Table Project Bootstrap Table

This affects versions before 1.19.1 of package bootstrap-table.

4.3
2021-11-03 CVE-2021-23784 Tempura Project Cross-site Scripting vulnerability in Tempura Project Tempura

This affects the package tempura before 0.4.0.

4.3
2021-11-03 CVE-2021-41174 Grafana Cross-site Scripting vulnerability in Grafana

Grafana is an open-source platform for monitoring and observability.

4.3
2021-11-03 CVE-2020-23126 Chamilo Cross-site Scripting vulnerability in Chamilo LMS 1.11.10

Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.

4.3
2021-11-03 CVE-2021-27836 Libxls Project
Fedoraproject
NULL Pointer Dereference vulnerability in multiple products

An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial of service, via a crafted XLS file.

4.3
2021-11-03 CVE-2021-40985 Htmldoc Project Classic Buffer Overflow vulnerability in Htmldoc Project Htmldoc

Buffer overflow vulnerability in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp.

4.3
2021-11-03 CVE-2021-43324 Librenms Cross-site Scripting vulnerability in Librenms

LibreNMS through 21.10.2 allows XSS via a widget title.

4.3
2021-11-03 CVE-2021-33210 Fimer Improper Authentication vulnerability in Fimer Aurora Vision

An issue was discovered in Fimer Aurora Vision before 2.97.10.

4.3
2021-11-03 CVE-2021-38491 Mozilla Unspecified vulnerability in Mozilla Firefox

Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.

4.3
2021-11-03 CVE-2021-38492 Mozilla Unspecified vulnerability in Mozilla Firefox

When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode.

4.3
2021-11-03 CVE-2021-38497 Mozilla Origin Validation Error vulnerability in Mozilla Firefox

Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks.

4.3
2021-11-03 CVE-2021-38502 Mozilla Insufficiently Protected Credentials vulnerability in Mozilla Thunderbird

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection.

4.3
2021-11-02 CVE-2018-6125 Google Unspecified vulnerability in Google Chrome

Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.

4.3
2021-11-02 CVE-2020-16048 Google Out-of-bounds Read vulnerability in Google Angle

Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.

4.3
2021-11-02 CVE-2021-37989 Google Unspecified vulnerability in Google Chrome

Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page.

4.3
2021-11-02 CVE-2021-37990 Google Unspecified vulnerability in Google Chrome

Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app.

4.3
2021-11-02 CVE-2021-37994 Google Unspecified vulnerability in Google Chrome

Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

4.3
2021-11-02 CVE-2021-37995 Google Unspecified vulnerability in Google Chrome

Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

4.3
2021-11-02 CVE-2021-37996 Google Improper Input Validation vulnerability in Google Chrome

Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a malicious file.

4.3
2021-11-02 CVE-2021-37980 Google
Fedoraproject
Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows.
4.3
2021-11-02 CVE-2021-36176 Fortinet Cross-site Scripting vulnerability in Fortinet Fortiportal

Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests.

4.3
2021-11-02 CVE-2020-21573 Image Processing Project Resource Exhaustion vulnerability in Image-Processing Project Image-Processing 0.1.0

An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted image file.

4.3
2021-11-02 CVE-2021-41019 Fortinet Improper Certificate Validation vulnerability in Fortinet Fortios

An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials.

4.3
2021-11-02 CVE-2020-35249 Elkarbackup Cross-site Scripting vulnerability in Elkarbackup 1.3.3

Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add client feature.

4.3
2021-11-02 CVE-2021-33611 Vaadin Cross-site Scripting vulnerability in Vaadin

Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

4.3
2021-11-01 CVE-2021-41310 Atlassian Cross-site Scripting vulnerability in Atlassian Jira Software Data Center

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Associated Projects feature (/secure/admin/AssociatedProjectsForCustomField.jspa).

4.3
2021-11-01 CVE-2021-38356 Nextscripts Cross-site Scripting vulnerability in Nextscripts Social Networks Auto Poster

The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].

4.3
2021-11-01 CVE-2021-42917 Kodi Classic Buffer Overflow vulnerability in Kodi

Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.

4.3
2021-11-01 CVE-2021-25875 Youphptube Cross-site Scripting vulnerability in Youphptube

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

4.3
2021-11-01 CVE-2021-25876 Youphptube Cross-site Scripting vulnerability in Youphptube

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

4.3
2021-11-01 CVE-2021-25878 Youphptube Cross-site Scripting vulnerability in Youphptube

AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

4.3
2021-11-01 CVE-2015-10001 WP Stats Project Cross-Site Request Forgery (CSRF) vulnerability in Wp-Stats Project Wp-Stats

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads

4.3
2021-11-01 CVE-2020-36504 WP PRO Quiz Project Cross-Site Request Forgery (CSRF) vulnerability in Wp-Pro-Quiz Project Wp-Pro-Quiz

The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog

4.3
2021-11-01 CVE-2020-36505 Delete ALL Comments Easily Project Cross-Site Request Forgery (CSRF) vulnerability in Delete ALL Comments Easily Project Delete ALL Comments Easily 1.3

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.

4.3
2021-11-01 CVE-2021-24570 Wpplugin Cross-Site Request Forgery (CSRF) vulnerability in Wpplugin Accept Donations With Paypal

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts.

4.3
2021-11-01 CVE-2021-24572 Wpplugin Cross-Site Request Forgery (CSRF) vulnerability in Wpplugin Accept Donations With Paypal

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts.

4.3
2021-11-01 CVE-2021-24799 Tipsandtricks HQ Cross-Site Request Forgery (CSRF) vulnerability in Tipsandtricks-Hq FAR Future Expiry Header

The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

4.3
2021-11-01 CVE-2021-24808 Wordplus Cross-site Scripting vulnerability in Wordplus Better Messages

The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

4.3
2021-11-01 CVE-2021-41973 Apache Infinite Loop vulnerability in Apache Mina 2.0.20/2.1.1

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely.

4.3
2021-11-01 CVE-2021-20839 Antennahouse XXE vulnerability in Antennahouse Office Server Document Converter

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by processing a specially crafted XML document.

4.3
2021-11-05 CVE-2021-41250 Pythondiscord Improper Input Validation vulnerability in Pythondiscord BOT

Python discord bot is the community bot for the Python Discord community.

4.0
2021-11-05 CVE-2021-3916 Bookstackapp Path Traversal vulnerability in Bookstackapp Bookstack

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

4.0
2021-11-05 CVE-2021-39901 Gitlab Unspecified vulnerability in Gitlab

In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.

4.0
2021-11-05 CVE-2021-39904 Gitlab Incorrect Authorization vulnerability in Gitlab

An Improper Access Control vulnerability in the GraphQL API in GitLab CE/EE since version 13.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request

4.0
2021-11-05 CVE-2021-39905 Gitlab Unspecified vulnerability in Gitlab

An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with

4.0
2021-11-05 CVE-2021-39911 Gitlab Incorrect Authorization vulnerability in Gitlab

An improper access control flaw in GitLab CE/EE since version 13.9 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers

4.0
2021-11-04 CVE-2021-39902 Gitlab Incorrect Authorization vulnerability in Gitlab

Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.

4.0
2021-11-04 CVE-2021-39903 Gitlab Incorrect Authorization vulnerability in Gitlab

In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.

4.0
2021-11-04 CVE-2021-43293 Sonatype Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).

4.0
2021-11-04 CVE-2021-34701 Cisco Path Traversal vulnerability in Cisco Unified Communications Manager

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), and Cisco Unity Connection could allow an authenticated, remote attacker to access sensitive data on an affected device.

4.0
2021-11-04 CVE-2021-34774 Cisco Information Exposure vulnerability in Cisco Common Services Platform Collector

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to access sensitive data on an affected system.

4.0
2021-11-04 CVE-2021-40126 Cisco Information Exposure Through an Error Message vulnerability in Cisco Umbrella

A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure.

4.0
2021-11-02 CVE-2020-15935 Fortinet Cleartext Storage of Sensitive Information vulnerability in Fortinet Fortiadc

A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields.

4.0
2021-11-02 CVE-2021-36184 Fortinet SQL Injection vulnerability in Fortinet Fortiwlm

A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests.

4.0
2021-11-02 CVE-2021-26107 Fortinet Incorrect Authorization vulnerability in Fortinet Fortimanager 6.4.4/6.4.5

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.

4.0
2021-11-02 CVE-2021-32595 Fortinet Resource Exhaustion vulnerability in Fortinet Fortiportal

Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests.

4.0
2021-11-02 CVE-2021-42568 Sonatype Information Exposure vulnerability in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.

4.0
2021-11-01 CVE-2021-24742 Radiustheme Incorrect Authorization vulnerability in Radiustheme Logo Slider and Showcase

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.

4.0
2021-11-01 CVE-2021-24770 Stylishpricelist Incorrect Authorization vulnerability in Stylishpricelist Stylish Price List

The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.

4.0
2021-11-01 CVE-2021-24781 Imagesourcecontrol Unspecified vulnerability in Imagesourcecontrol Image Source Control

The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)

4.0
2021-11-01 CVE-2021-41313 Atlassian Missing Authorization vulnerability in Atlassian Jira Software Data Center

Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint.

4.0

82 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2021-11-05 CVE-2021-41205 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-41211 Google Out-of-bounds Read vulnerability in Google Tensorflow 2.6.0

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-41212 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-41223 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-41224 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-41226 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-41210 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

3.6
2021-11-05 CVE-2021-25509 Samsung Improper Input Validation vulnerability in Samsung Flow

A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders.

3.6
2021-11-01 CVE-2021-22563 Libjxl Project Out-of-bounds Read vulnerability in Libjxl Project Libjxl

Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines.

3.6
2021-11-07 CVE-2021-25978 Apostrophecms Cross-site Scripting vulnerability in Apostrophecms

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

3.5
2021-11-05 CVE-2021-42664 Engineers Online Portal Project Cross-site Scripting vulnerability in Engineers Online Portal Project Engineers Online Portal 1.0

A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php.

3.5
2021-11-05 CVE-2021-26844 Poweradmin Cross-site Scripting vulnerability in Poweradmin PA Server Monitor 8.2.1.1

A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe.

3.5
2021-11-05 CVE-2021-42662 Online Event Booking AND Reservation System Project Cross-site Scripting vulnerability in Online Event Booking and Reservation System Project Online Event Booking and Reservation System 2.3.0

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason parameter.

3.5
2021-11-05 CVE-2021-22260 Gitlab Cross-site Scripting vulnerability in Gitlab

A stored Cross-Site Scripting vulnerability in the DataDog integration in GitLab CE/EE version 13.7 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf

3.5
2021-11-05 CVE-2021-39909 Gitlab Improper Verification of Cryptographic Signature vulnerability in Gitlab

Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE since version 11.3 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

3.5
2021-11-04 CVE-2021-34731 Cisco Cross-site Scripting vulnerability in Cisco Prime Access Registrar

A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system.

3.5
2021-11-04 CVE-2021-34784 Cisco Cross-site Scripting vulnerability in Cisco products

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.

3.5
2021-11-03 CVE-2021-38403 Deltaww Cross-site Scripting vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execute code.

3.5
2021-11-03 CVE-2021-38407 Deltaww Cross-site Scripting vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code.

3.5
2021-11-03 CVE-2021-38411 Deltaww Cross-site Scripting vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code.

3.5
2021-11-03 CVE-2021-38428 Deltaww Cross-site Scripting vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.

3.5
2021-11-03 CVE-2021-38488 Deltaww Cross-site Scripting vulnerability in Deltaww Dialink 1.2.4.0

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute code.

3.5
2021-11-03 CVE-2021-43032 Xenforo Cross-site Scripting vulnerability in Xenforo

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document.

3.5
2021-11-03 CVE-2021-41134 Jupyter Cross-site Scripting vulnerability in Jupyter Nbdime and Nbdime-Jupyterlab

nbdime provides tools for diffing and merging of Jupyter Notebooks.

3.5
2021-11-03 CVE-2021-36698 Artica Cross-site Scripting vulnerability in Artica Pandora FMS

Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.

3.5
2021-11-02 CVE-2021-43265 Mahara Cross-site Scripting vulnerability in Mahara

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.

3.5
2021-11-02 CVE-2021-42754 Fortinet Code Injection vulnerability in Fortinet Forticlient

An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file.

3.5
2021-11-02 CVE-2020-12814 Fortinet Cross-site Scripting vulnerability in Fortinet Fortianalyzer

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows attacker to execute unauthorized code or commands via specifically crafted requests to the web GUI.

3.5
2021-11-02 CVE-2020-15940 Fortinet Cross-site Scripting vulnerability in Fortinet Forticlient Enterprise Management Server

An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server.

3.5
2021-11-02 CVE-2021-36181 Fortinet Race Condition vulnerability in Fortinet Fortiportal

A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests.

3.5
2021-11-02 CVE-2021-29771 IBM Cross-site Scripting vulnerability in IBM Infosphere Information Server 11.7

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.

3.5
2021-11-02 CVE-2020-27406 Dynpg Cross-site Scripting vulnerability in Dynpg 4.9.1

Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.

3.5
2021-11-01 CVE-2021-31848 Mcafee Cross-site Scripting vulnerability in Mcafee Data Loss Prevention Endpoint 11.6.0/11.6.100.41

Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the DLP ePO extension.

3.5
2021-11-01 CVE-2015-20019 Content Text Slider ON Post Project Cross-site Scripting vulnerability in Content Text Slider on Post Project Content Text Slider on Post

The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues

3.5
2021-11-01 CVE-2021-24624 Sonaar Cross-site Scripting vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks

3.5
2021-11-01 CVE-2021-24682 Wpkube Cross-site Scripting vulnerability in Wpkube Cool TAG Cloud

The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

3.5
2021-11-01 CVE-2021-24715 WP Sitemap Page Project Cross-site Scripting vulnerability in WP Sitemap Page Project WP Sitemap Page

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

3.5
2021-11-01 CVE-2021-24716 Webnus Cross-site Scripting vulnerability in Webnus Modern Events Calendar Lite

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.

3.5
2021-11-01 CVE-2021-24722 Motopress Cross-site Scripting vulnerability in Motopress Restaurant Menu 2.4.0

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

3.5
2021-11-01 CVE-2021-24723 Wpreactions Cross-site Scripting vulnerability in Wpreactions WP Reactions Lite

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.

3.5
2021-11-01 CVE-2021-24773 Wpdownloadmanager Cross-site Scripting vulnerability in Wpdownloadmanager Wordpress Download Manager

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed

3.5
2021-11-01 CVE-2021-24789 Flat Preloader Project Cross-site Scripting vulnerability in Flat Preloader Project Flat Preloader

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

3.5
2021-11-01 CVE-2021-24793 Etruel Cross-site Scripting vulnerability in Etruel Wpematico RSS Feed Fetcher

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

3.5
2021-11-01 CVE-2021-24794 Connections PRO Cross-site Scripting vulnerability in Connections-Pro Connections Business Directory

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.

3.5
2021-11-01 CVE-2021-24813 E Dynamics Cross-site Scripting vulnerability in E-Dynamics Events Made Easy

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

3.5
2021-11-05 CVE-2021-25507 Samsung Incorrect Authorization vulnerability in Samsung Flow

Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to access part of notification data in Secure Folder without authorization.

2.7
2021-11-05 CVE-2021-41251 SAP Information Exposure vulnerability in SAP Cloud SDK

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions.

2.6
2021-11-05 CVE-2021-42701 Azeotech Modification of Assumed-Immutable Data (MAID) vulnerability in Azeotech Daqfactory

An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack.

2.6
2021-11-04 CVE-2021-41248 Graphql Cross-site Scripting vulnerability in Graphql Graphiql

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation.

2.6
2021-11-04 CVE-2021-41249 Graphql Cross-site Scripting vulnerability in Graphql Playground

GraphQL Playground is a GraphQL IDE for development of graphQL focused applications.

2.6
2021-11-05 CVE-2021-41222 Google Unspecified vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41225 Google Use of Uninitialized Resource vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41227 Google Out-of-bounds Read vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41202 Google Incorrect Conversion between Numeric Types vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41207 Google Divide By Zero vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41209 Google Divide By Zero vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41218 Google Divide By Zero vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41204 Google Access of Uninitialized Pointer vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41215 Google NULL Pointer Dereference vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41217 Google NULL Pointer Dereference vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41195 Google Integer Overflow or Wraparound vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41196 Google Integer Underflow (Wrap or Wraparound) vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41197 Google Integer Overflow or Wraparound vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41198 Google Integer Overflow or Wraparound vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41199 Google Integer Overflow or Wraparound vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-41200 Google Reachable Assertion vulnerability in Google Tensorflow

TensorFlow is an open source platform for machine learning.

2.1
2021-11-05 CVE-2021-25500 Google Improper Input Validation vulnerability in Google Android 10.0/11.0

A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise.

2.1
2021-11-05 CVE-2021-25501 Google Incorrect Authorization vulnerability in Google Android 10.0/11.0

An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some protected providers.

2.1
2021-11-05 CVE-2021-25502 Google Cleartext Storage of Sensitive Information vulnerability in Google Android

A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge.

2.1
2021-11-05 CVE-2021-25504 Samsung Improper Input Validation vulnerability in Samsung Group Sharing

Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.

2.1
2021-11-05 CVE-2021-25506 Samsung Incorrect Authorization vulnerability in Samsung Health

Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service.

2.1
2021-11-05 CVE-2021-39895 Gitlab Unspecified vulnerability in Gitlab

In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project.

2.1
2021-11-04 CVE-2021-43389 Linux
Redhat
Out-of-bounds Read vulnerability in multiple products

An issue was discovered in the Linux kernel before 5.14.15.

2.1
2021-11-03 CVE-2021-36192 Fortinet Exposure of Resource to Wrong Sphere vulnerability in Fortinet Fortimanager

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may allow a FortiGate user to see scripts from other ADOMS.

2.1
2021-11-03 CVE-2021-39237 HP Unspecified vulnerability in HP Futuresmart 3, Futuresmart 4 and Futuresmart 5

Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosure.

2.1
2021-11-02 CVE-2021-43264 Mahara Path Traversal vulnerability in Mahara

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal.

2.1
2021-11-02 CVE-2021-41023 Fortinet Cleartext Storage of Sensitive Information vulnerability in Fortinet Fortisiem

A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due to plaintext credential storage in log files

2.1
2021-11-01 CVE-2021-39340 Bracketspace Cross-site Scripting vulnerability in Bracketspace Notification

The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 7.2.4.

2.1
2021-11-01 CVE-2021-39346 Supsystic Cross-site Scripting vulnerability in Supsystic Easy Google Maps

The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.9.33.

2.1
2021-11-01 CVE-2021-22564 Libjxl Project Out-of-bounds Write vulnerability in Libjxl Project Libjxl

For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups out of order the decoder can perform an out of bounds copy of image pixels from an image buffer in the heap to another.

2.1
2021-11-01 CVE-2021-24539 Dazzlersoftware Cross-site Scripting vulnerability in Dazzlersoftware Coming Soon, Under Construction & Maintenance Mode BY Dazzler

The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

2.1
2021-11-01 CVE-2021-27004 Netapp Insecure Storage of Sensitive Information vulnerability in Netapp Ontap System Manager 9.7/9.8/9.9.12

System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local attacker to discover plaintext iSCSI CHAP credentials.

1.7