| Vulners.com -- CVE-2015-20105 |
| Vulners.com -- CVE-2021-23258 |
| Vulners.com -- CVE-2021-23259 |
| Vulners.com -- CVE-2021-23262 |
| Vulners.com -- Important: mailman:2.1 security update |
| Vulners.com -- CVE-2021-43679 |
| Vulners.com -- CVE-2021-44227 |
| Vulners.com -- CVE-2021-42711 |
| Vulners.com -- CVE-2020-35012 |
| Vulners.com -- CVE-2021-33269 |
| Vulners.com -- Warning: Yet Another Zoho ManageEngine Product Found Under Active Attacks |
| Vulners.com -- CVE-2021-33266 |
| Vulners.com -- CVE-2021-25784 |
| Vulners.com -- CVE-2021-33270 |
| Vulners.com -- CVE-2021-25783 |
| Vulners.com -- CVE-2021-33271 |
| Vulners.com -- CVE-2020-36131 |
| Vulners.com -- (RHSA-2021:4916) Important: mailman:2.1 security update |
| Vulners.com -- CVE-2020-36129 |
| Vulners.com -- (RHSA-2021:4915) Important: mailman:2.1 security update |
| Vulners.com -- CVE-2020-36133 |
| CVE-2021-20470 -- IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.
|
| CVE-2021-23562 -- This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file. |
| CVE-2021-23758 -- All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
|
| CVE-2021-23758 -- All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution. |
| CVE-2021-29716 -- IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view. IBM X-Force ID: 201087. |
| CVE-2021-29719 -- IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect content type. IBM X-Force ID: 201091 |
| CVE-2021-29756 -- IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202 |
| CVE-2021-29867 -- IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212. |
| CVE-2021-35344 -- tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h. |
| CVE-2021-35346 -- tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_set(int) in hevc.cpp. |
| CVE-2021-35413 -- A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file. |
| CVE-2021-35414 -- Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. |
| CVE-2021-35415 -- A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields. |
| CVE-2021-38909 -- IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a |
| CVE-2021-3980 -- elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor |
| CVE-2021-4000 -- showdoc is vulnerable to URL Redirection to Untrusted Site
|
| CVE-2021-43415 -- HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1. |
| CVE-2021-43673 -- dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of exit function will be print for the user exit(json_encode($return)). |
| CVE-2021-43674 -- ** UNSUPPORTED WHEN ASSIGNED ** ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. |
| CVE-2021-43676 -- matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. |
| CVE-2021-43772 -- Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any detection.
|
| CVE-2021-43991 -- The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client suppl |
| CVE-2021-44021 -- An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged cod |
| CVE-2021-44022 -- A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code |
| CVE-2021-44278 -- Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. |
| CVE-2021-44347 -- SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php. |
| CVE-2021-44348 -- SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php. |
| CVE-2021-44349 -- SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php. |
| CVE-2021-44352 -- A Stack-based Buffer Overflow vlnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in goform/SetIpMacBind. |
| Vulners.com -- CVE-2021-4017 |
| Vulners.com -- CVE-2021-20859 |
| Vulners.com -- Security Bulletin: A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager |
| Vulners.com -- CVE-2021-20860 |
| Vulners.com -- CVE-2021-20863 |
| Vulners.com -- Security Bulletin: A security vulnerability in Node.js jsonpointer module affects IBM Cloud Automation Manager |
| Vulners.com -- CVE-2021-20851 |
| Vulners.com -- CVE-2021-20864 |
| Vulners.com -- Ubuntu Overlayfs Local Privilege Escalation |
| Vulners.com -- CVE-2021-43359 |
| Vulners.com -- (RHSA-2021:4827) Important: OpenShift Container Platform 3.11.569 security update |
| Vulners.com -- CVE-2021-43360 |
| Vulners.com -- (RHSA-2021:4799) Important: OpenShift Container Platform 4.6.51 packages and security update |
| Vulners.com -- CVE-2021-36330 |
| Vulners.com -- CISA and FBI Release Alert on Active Exploitation of CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus |
| Vulners.com -- mailman security update |
| Vulners.com -- AT&T Takes Steps to Mitigate Botnet Found Inside Its Network |
| Vulners.com -- Why Everyone Needs to Take the Latest CISA Directive Seriously |
| Vulners.com -- CISA Warns of Actively Exploited Critical Zoho ManageEngine ServiceDesk Vulnerability |
| Vulners.com -- Threat Group Takes Aim Again at Cloud Platform Provider Zoho |
| Vulners.com -- Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities |
| Vulners.com -- CVE-2021-33265 |
| Vulners.com -- CVE-2021-38575 |
| Vulners.com -- CVE-2021-42776 |
| Vulners.com -- CVE-2021-43685 |
| Vulners.com -- CVE-2021-44280 |
| Vulners.com -- CVE-2021-32592 |
| Vulners.com -- CVE-2021-3994 |
| CVE-2015-20105 -- The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it cou |
| CVE-2015-20106 -- The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
|
| CVE-2020-27414 -- Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header, MITM or browser history.
|
| CVE-2020-29176 -- An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file. |
| CVE-2020-29177 -- Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php. |
| CVE-2020-36129 -- AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c. |
| CVE-2020-36130 -- AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c. |
| CVE-2020-36131 -- AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c. |
| CVE-2020-36133 -- AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h. |
| CVE-2020-36134 -- AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c. |
| CVE-2020-36135 -- AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c. |
| CVE-2021-23258 -- Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE). |
| CVE-2021-23259 -- Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands r |
| CVE-2021-23260 -- Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. |
| CVE-2021-23261 -- Authenticated administrators may override the system configuration file and cause a denial of service. |
| CVE-2021-23262 -- Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. |
| CVE-2021-23263 -- Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). |
| CVE-2021-23264 -- Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. |
| CVE-2021-25783 -- Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search. |
| CVE-2021-25784 -- Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article. |
| CVE-2021-25785 -- Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column. |
| CVE-2021-26777 -- Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare version CIR_CDC_v1.2.17, allows attackers to execute arbitrary code. |
| CVE-2021-28236 -- LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c. |
| CVE-2021-28237 -- LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. |
| CVE-2021-3944 -- bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
| CVE-2021-40333 -- Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitach |
| CVE-2021-40334 -- Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulnerability by activating SSH on port TCP 5558 to cause disruption to the NMS and NE communication. |
| CVE-2021-43327 -- An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID key from the device. Then, the protected firmware can be extracted.
|
| CVE-2021-43679 -- ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php. |
| CVE-2021-43681 -- SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and print the message $data['proxy_name']. |
| CVE-2021-43682 -- thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function will terminate the script and print the message to the user which has $_SERVER['HTTP_HOST']. |
| CVE-2021-43683 -- pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will terminate the script and print the message which has $_REQUEST['hash']. |
| CVE-2021-43686 -- nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $_GET['t']. |
| CVE-2021-43791 -- Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account regi |
| CVE-2021-43795 -- Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fse |
| CVE-2021-44050 -- CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data. |
| CVE-2021-44227 -- In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes. |
| CVE-2021-44518 -- An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or unlock) activated via the companion app. The code is sent unencrypted, allowing any attacker with |
| Vulners.com -- CVE-2021-26612 |
| Vulners.com -- APT annual review 2021 |
| Vulners.com -- CVE-2021-43691 |
| Vulners.com -- Security Bulletin: IBM QRadar SIEM Application Framework v1 (CentOS6) is End of Life |
| Vulners.com -- Security update for permissions (moderate) |
| Vulners.com -- CVE-2021-41035 |
| Vulners.com -- (RHSA-2021:4829) Important: OpenShift Container Platform 4.8.22 security update |
| Vulners.com -- CVE-2021-39995 |
| Vulners.com -- Security Bulletin: Linux Kernel as used by IBM QRadar SIEM contains multiple vulnerabilities |
| Vulners.com -- mailman:2.1 security update |
| Vulners.com -- CVE-2021-43202 |
| Vulners.com -- CVE-2021-43790 |
| Vulners.com -- CVE-2021-43693 |
| Vulners.com -- Security Bulletin: Multiple vulnerabilities affect IBM HTTP Server (powered by Apache) for i |
| Vulners.com -- Security update for webkit2gtk3 (important) |
| Vulners.com -- (RHSA-2021:4875) Important: kernel-rt security and bug fix update |
| Vulners.com -- Open Design Alliance (ODA) ODAViewer DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability |
| Vulners.com -- (RHSA-2021:4848) Moderate: Migration Toolkit for Containers (MTC) 1.5.2 security update and bugfix advisory |
| Vulners.com -- Security update for the Linux Kernel (important) |
| Vulners.com -- (RHSA-2021:4871) Important: kernel security and bug fix update |
| Vulners.com -- Open Design Alliance (ODA) ODAViewer DGN File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability |
| Vulners.com -- (RHSA-2021:4845) Moderate: Red Hat OpenShift Container Storage 4.8.5 Security and Bug Fix Update |
| Vulners.com -- Security update for poppler (important) |
| Vulners.com -- CVE-2021-41678 |
| Vulners.com -- InHand Networks IR615 Router (Update A) |
| Vulners.com -- (RHSA-2021:4833) Important: OpenShift Container Platform 4.9.9 security update |
| Vulners.com -- (RHSA-2021:4902) Moderate: ACS 3.67 security and enhancement update |
| Vulners.com -- CVE-2021-41679 |
| Vulners.com -- Open Design Alliance (ODA) ODAViewer DWF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| Vulners.com -- CVE-2021-24748 |
| Vulners.com -- New EwDoor Botnet Targeting Unpatched AT&T Network Edge Devices |
| Vulners.com -- (RHSA-2021:4859) Important: kpatch-patch security update |
| Vulners.com -- Multiple RTOS (Update D) |
| Vulners.com -- CVE-2021-24889 |
| Vulners.com -- (RHSA-2021:4918) Moderate: Red Hat Integration Camel-K 1.6 release and security update |
| Vulners.com -- (RHSA-2021:4801) Important: OpenShift Container Platform 4.7.38 security update |
| Vulners.com -- CVE-2021-41677 |
| Vulners.com -- Google Chrome Blink setBaseAndExtent use after free vulnerability |
| Vulners.com -- CVE-2021-24860 |
| Vulners.com -- Security Bulletin: Multiple vulnerabilities may affect IBM® Semeru Runtime |
| Vulners.com -- CVE-2021-43358 |
| Vulners.com -- Critical Wormable Security Flaw Found in Several HP Printer Models |
| Vulners.com -- Johnson Controls CEM Systems AC2000 |
| Vulners.com -- CVE-2021-24755 |
| Vulners.com -- (RHSA-2021:4914) Moderate: OpenShift Virtualization 4.8.3 Images security and bug fix update |
| Vulners.com -- CVE-2021-40809 |
| Vulners.com -- CVE-2021-42123 |
| Vulners.com -- Linux kernel (OEM) vulnerabilities |
| Vulners.com -- CVE-2021-24915 |
| Vulners.com -- (RHSA-2021:4913) Important: mailman security update |
| Vulners.com -- CISA Adds Five Known Exploited Vulnerabilities to Catalog |
| Vulners.com -- CVE-2021-42544 |
| Vulners.com -- Linux kernel vulnerabilities |
| Vulners.com -- CVE-2021-42575 |
| Vulners.com -- Hitachi Energy Relion 670/650/SAM600-IO |
| Vulners.com -- CVE-2021-36328 |
| Vulners.com -- CVE-2021-3727 |
| Vulners.com -- CVE-2021-44427 |
| Vulners.com -- CVE-2021-44077 |
| Vulners.com -- Hitachi Energy APM Edge |
| Vulners.com -- CVE-2021-40101 |
| Vulners.com -- CVE-2021-3725 |
| Vulners.com -- IKEA Hit by Email Reply-Chain Cyberattack |
| Vulners.com -- Open Design Alliance (ODA) Drawings Explorer DWF File Parsing Out-Of-Based Write Remote Code Execution Vulnerability |
| Vulners.com -- Hitachi Energy RTU500 series |
| Vulners.com -- CVE-2020-7880 |
| Vulners.com -- CVE-2021-3726 |
| Vulners.com -- CVE-2021-42358 |
| Vulners.com -- Open Design Alliance (ODA) Drawings Explorer DWF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| Vulners.com -- Hitachi Energy RTU500 series BCI |
| Vulners.com -- CVE-2020-7879 |
| Vulners.com -- CVE-2021-3769 |
| Vulners.com -- CVE-2021-42364 |
| Vulners.com -- Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities |
