default_status: unknown

product: Track-It!

vendor: BMC

status: affected

ecosystem: software/application

metric_type: Primary

severity: medium

metric_type: Secondary

severity: low

part: a

product: track-it!

vendor: bmc

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetData endpoint. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-14527.

title: Bmc Track-It! security vulnerability


version_type: custom

severity: high

summary: BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14122.

title: Bmc Track-It! security vulnerability


product: Archer C90

vendor: TP-Link

ecosystem: operating-system

severity: critical

part: o

vendor: tp-link

status: Modified

summary: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 rel.73164(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14655.

title: Tp-Link Archer C90 Firmware security vulnerability


summary: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 rel.66244(5553) wireless access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14656.

title: Tp-Link Tl-Wa1201 Firmware security vulnerability


product: ZyWALL VPN2S Firmware

vendor: Zyxel

vendor: zyxel

summary: A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.

title: Zyxel Zywall Vpn2S Firmware security vulnerability


summary: A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.


product: USG/Zywall series Firmware

product: USG FLEX series Firmware

product: ATP series Firmware

product: VPN series Firmware

summary: An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.

title: Zyxel Usg1900 Firmware security vulnerability


product: GS1900-8 Firmware

summary: A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.

title: Zyxel Gs1900-8 Firmware security vulnerability


product: GS1900 series firmware

product: XGS1210 series firmware

product: XGS1250 series firmware

summary: A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device.


summary: A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call.


product: NBG6818 series firmware

product: NBG7815 series firmware

product: WSQ20 series firmware

product: WSQ50 series firmware

product: WSQ60 series firmware

product: WSR30 series firmware

summary: A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.

title: Zyxel Nbg6818 Firmware security vulnerability


product: NBG6604 series firmware

summary: An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.

title: Zyxel Nbg6604 Firmware security vulnerability


summary: A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive information from the configuration file.


product: VMG3625-T50B firmware

summary: A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain sensitive information from the configuration file.

title: Zyxel Ax7501-B0 Firmware security vulnerability


product: jamf

vendor: jamf

summary: Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-premises. An attacker may craft a URL that appears to be for a customer's Jamf Pro instance, but when clicked will forward a user to an arbitrary URL that may be malicious. This is tracked via Jamf with the following ID: PI-009822

title: Jamf security vulnerability


ecosystem: linux/kernel

vendor: linux

vendor: debian

summary: kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.


product: fisco-bcos

vendor: fisco-bcos

summary: The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory sustainably and crash. More details are shown at: https://github.com/FISCO-BCOS/FISCO-BCOS/issues/1951


product: django

vendor: djangoproject

product: fedora

vendor: fedoraproject

summary: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

title: Djangoproject Django security vulnerability


ecosystem: javascript/npm

product: antisamy

vendor: oracle

summary: OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.


product: icehrm

vendor: icehrm

summary: Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint.

title: Icehrm security vulnerability


summary: A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie.

title: Icehrm security vulnerability


product: Fidelis Network

vendor: Fidelis Cybersecurity

version: Fidelis Network 9.4

version: Fidelis Network

product: Fidelis Deception

version: Fidelis Deception 9.4

version: Fidelis Deception

product: deception

vendor: fidelissecurity

product: network

summary: Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

title: Fidelissecurity Deception security vulnerability


summary: Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.


summary: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.


summary: User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.


product: Kaspersky Password Manager for Windows

version: KPM for Windows prior to 9.0.2 Patch R

vendor: kaspersky

summary: A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.


product: Kaspersky Endpoint Security for Windows

version: KES versions from 11.1 to 11.6 (inclusively)

ecosystem: browser

summary: Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable.


product: minecraft

vendor: minecraft

summary: Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.


vendor: mediatek

summary: MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 7.4.0.0; Out-of-bounds write).


ecosystem: windows/system

product: stealth

vendor: unisys

summary: Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run.


vendor: openwaygroup

summary: OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.


summary: /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.

title: Openwaygroup Way4 security vulnerability


product: testerfassung

vendor: drk-odenwaldkreis

summary: Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components.

title: Drk-Odenwaldkreis Testerfassung security vulnerability


vendor: testzentrum-odw

summary: A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid token of a COVID-19 test result to execute shell commands with the permissions of the web server.

title: Testzentrum-Odw Testerfassung security vulnerability


archetype: generic

product: suricata

vendor: oisf

summary: Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion."


product: viaware

vendor: kramerav

summary: KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg.


product: glob-parent

vendor: gulpjs

summary: The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

title: Gulpjs Glob-Parent security vulnerability


archetype: xxe

product: automate

vendor: connectwise

summary: An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.


vendor: meross

summary: Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message can transmit an acceptable Open message).

title: Meross Msg100 Firmware security vulnerability


vendor: Qualcomm, Inc.

vendor: qualcomm

summary: Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables

title: Qualcomm Apq8009W Firmware security vulnerability


product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Netw…

summary: Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking


summary: RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile

title: Qualcomm Qcm6125 Firmware security vulnerability


summary: Possible buffer over read due to lack of size validation while copying data from DBR buffer to RX buffer and can lead to Denial of Service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

title: Qualcomm Aqt1000 Firmware security vulnerability


summary: Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

title: Qualcomm Apq8009 Firmware security vulnerability


summary: Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

title: Qualcomm Ar8035 Firmware security vulnerability


summary: Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible null pointer dereference due to improper validation of RRC connection reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables


summary: Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

title: Qualcomm Apq8053 Firmware security vulnerability


summary: Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

title: Qualcomm Qcm2290 Firmware security vulnerability


summary: Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music


product: Snapdragon Industrial IOT

summary: Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT


product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & M…

summary: Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Possible out of bound read due to lack of length check of data length for a DIAG event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music


summary: Possible buffer overflow due to lack of buffer length check during management frame Rx handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible buffer over read due to improper validation of SIB type when processing a NR system Information message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible null pointer access due to improper validation of system information message to be processed in Snapdragon Industrial IOT, Snapdragon Mobile


product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networki…

summary: Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking


product: Snapdragon Auto

summary: Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon Auto


summary: Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible out of bounds read due to improper typecasting while handling page fault for global memory in Snapdragon Connectivity, Snapdragon Mobile

title: Qualcomm Sd 8 Gen1 5G Firmware security vulnerability


summary: Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music


product: BlueCore

summary: Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore

title: Qualcomm Csr8510 A10 Firmware security vulnerability


summary: Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in Snapdragon Connectivity, Snapdragon Mobile


summary: Improper memory allocation during counter check DLM handling can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile


summary: Possible buffer overflow due to lack of validation for the length of NAI string read from EFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile


summary: Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking


product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and N…

summary: Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking


summary: Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Possible out of bound read due to improper length calculation of WMI message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile


summary: Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile


summary: Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon Mobile


summary: Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile


summary: A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables


summary: Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto


product: Snapdragon Auto, Snapdragon Mobile

summary: Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile


summary: APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data executing there in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables


summary: An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

title: Qualcomm Apq8096Au Firmware security vulnerability


summary: An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables


summary: Potential out of Bounds read in FIPS event processing due to improper validation of the length from the firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables


summary: Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT


summary: Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

title: Qualcomm Qam8295P Firmware security vulnerability


summary: Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking


summary: Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables


summary: Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables


summary: Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile


summary: Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

title: Qualcomm Qca6391 Firmware security vulnerability


summary: A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

title: Qualcomm Apq8017 Firmware security vulnerability


product: eaglesoft

vendor: pattersondental

summary: Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations (that have the same software version). This provides remote access to SQL database credentials. (In the normal use of the product, retrieving those credentials only occurs after a username/password authentication step; however, this authentication step is on the client side, and an attacker can develop their own client that skips this step.)

title: Pattersondental Eaglesoft security vulnerability


product: manuskript

vendor: theologeek

summary: Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file

title: Theologeek Manuskript security vulnerability


product: mediawiki

vendor: mediawiki

vendor: debian

product: fedora

vendor: fedoraproject

summary: In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).


product: ngeniusone

vendor: netscout

summary: NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.


summary: NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.


summary: NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.


summary: NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.


summary: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.


summary: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.


summary: NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.


summary: NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.


product: gitpod

vendor: gitpod

summary: Gitpod before 0.6.0 allows unvalidated redirects.


product: collaboration

vendor: zimbra

summary: An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.


summary: An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.


archetype: ssrf

ecosystem: java/maven

summary: An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting).

title: Zimbra Collaboration security vulnerability


product: contao

vendor: contao

summary: Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.


product: Serv-U Managed File Transfer Server and Serv-U Secured FTP

vendor: SolarWinds

version: SolarWinds Serv-U

business_risk: Critical remote unauthenticated code execution in SolarWinds Serv-U can provide privileged access to the Windows host, enabling installation or execution of programs and unauthorized viewing, modification, or deletion of data. CVE-2021-35211 is listed in CISA's Known Exploited Vulnerabilities catalog.

claim: Microsoft reports that successful exploitation is possible when Serv-U SSH is exposed to the internet and can allow remote arbitrary code execution with privileges.

kind: exposure

claim: Microsoft identifies Serv-U DebugSocketLog.txt exceptions and anomalous Serv-U child processes as investigation indicators, while noting that an exception can also occur for unrelated reasons.

kind: verification

claim: CVE-2021-35211 is classified by NVD as a SolarWinds Serv-U remote code execution vulnerability and is included in CISA's Known Exploited Vulnerabilities catalog.

exposure_conditions: SolarWinds Serv-U Managed File Transfer Server or Serv-U Secured FTP on Windows is installed.

exposure_conditions: The installed version is Serv-U 15.2.3 HF1 or any earlier version; SolarWinds states that versions before 15.2.3 HF2 are affected.

exposure_conditions: Risk is materially increased when Serv-U SSH is enabled and reachable by an attacker, including from the internet.

exposure_conditions: Linux versions are not vulnerable to the reported RCE according to SolarWinds, although the Linux product may crash when exploitation is attempted.

remediation_steps: Upgrade Serv-U to the vendor-fixed release, Serv-U 15.2.3 HF2, using the SolarWinds Customer Portal.

remediation_steps: For Serv-U 15.2.3 HF1, apply HF2 directly.

remediation_steps: For Serv-U 15.2.3, apply HF1 and then HF2.

remediation_steps: For versions earlier than 15.2.3, upgrade to 15.2.3, then apply HF1 and HF2.

remediation_steps: Until patching is complete, restrict or disable externally reachable Serv-U SSH where operationally feasible and apply compensating network controls.

status: complete

uncertainty: The supplied record contains inconsistent boundary wording, including a less-than value of 15.2.3 HF1 and CPE entries involving 15.2.3 and HF1. SolarWinds' advisory explicitly identifies Serv-U 15.2.3 HF1 and all prior versions as affected, and Serv-U 15.2.3 HF2 as fixed; that vendor statement is used here.

uncertainty: The advisory does not establish that every deployment with SSH enabled is internet-exposed; exposure depends on network reachability and access controls.

uncertainty: Log and telemetry indicators can support investigation but do not independently prove exploitation.

verification_steps: Confirm the installed Serv-U version and hotfix level is Serv-U 15.2.3 HF2 or later according to the vendor's supported version-identification procedure.

verification_steps: Confirm that no affected Serv-U instance remains in the deployment inventory, including systems running Serv-U Managed File Transfer or Serv-U Secured FTP on Windows.

verification_steps: Review Serv-U DebugSocketlog.txt and relevant endpoint or network telemetry for suspicious exceptions, SSH activity, anomalous child processes, unexpected global users, or other indicators identified by SolarWinds and Microsoft. Treat individual exceptions as non-conclusive and investigate them in context.

verification_steps: If compromise indicators are present, isolate the host according to incident-response procedures and contact SolarWinds Support; patching alone should not be treated as evidence that prior compromise did not occur.

known_ransomware_campaign_use: Known

product: Serv-U

required_action: Apply updates per vendor instructions.

vendor_project: SolarWinds

vulnerability_name: SolarWinds Serv-U Remote Code Execution Vulnerability

product: serv-u

vendor: solarwinds

summary: Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.


product: Orion Platform

version: 2020.2.5 and previous versions

summary: An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user.


summary: An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to exploit the vulnerability.


product: Pingdom

product: pingdom

summary: The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.


summary: Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.


product: Patch Manager

version: 2020.2.5 and previous versions.

summary: Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.

title: Solarwinds Patch Manager security vulnerability


summary: Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.


version: 2020.5 and previous versions

summary: Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server


version: 2020.2.6 and previous versions

summary: ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.


summary: Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.


summary: Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

title: Solarwinds Orion Platform security vulnerability


summary: This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.


version: 15.2.3 and previous versions

summary: The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.


product: NPM

version: 2020.2.6 Hotfix 1 and previous versions

summary: Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.

title: Solarwinds Network Performance Monitor security vulnerability


default_status: unaffected

product: Network Configuration Manager

version: 2020.2.5 and previous version

summary: An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.


product: Access Rights Manager

summary: The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.


product: SolarWinds

summary: This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim.

title: Solarwinds Database Performance Analyzer security vulnerability


product: Database Performance Monitor

version: 2022.1.7779 and previous versions

summary: Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query


product: Kiwi CatTools

version: unspecified

summary: As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry.

title: Solarwinds Kiwi Cattools security vulnerability


product: Kiwi Syslog Server

version: 9.7.2 and previous versions

summary: As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application".

title: Solarwinds Kiwi Syslog Server security vulnerability


product: Web Help Desk

version: 12.7.7 and previous versions

product: webhelpdesk

summary: Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.


summary: The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.


product: Orion Core

version: 2020.2.6 HF 2 and previous versions

summary: Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information.


summary: The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.


version: 9.7.2 and Previous Versions

summary: The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.


summary: A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.


summary: User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.


summary: A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.


summary: A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.


product: Serv-U Server

version: 15.2.4 Hotfix 1 and previous versions

summary: Serv-U server responds with valid CSRFToken when the request contains only Session.


version: 12.7.7 and previous versions 12.7.7 HF1

summary: The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.

title: Solarwinds Web Help Desk security vulnerability


summary: The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.


product: Serv-U FTP

summary: When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.

title: Solarwinds Serv-U security vulnerability


product: Engineer's Toolset

version: 2022.3 and previous versions

summary: The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users.


product: Serv-U

version: 15.2.5 and previous versions

known_ransomware_campaign_use: Unknown

vulnerability_name: SolarWinds Serv-U Improper Input Validation Vulnerability

product: serv-u

summary: Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.


product: Orion

summary: It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.


version: 15.3 and previous versions

summary: This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.


less_than: 15.3 Hotfix 1

version: 15.3 only

summary: A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.


version: 12.7.7 HF 1 and Previous Versions

summary: Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.


product: Serv-U FTP Server

summary: Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.


product: WebHelpDesk

version: 12.7.8 and previous versions

summary: SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.


product: bearadmin

summary: File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the Upfile function of the extend/tools/Ueditor endpoint.

title: Bearadmin Project Bearadmin security vulnerability


vendor: maxsite

summary: A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.

title: Maxsite Maxsite Cms security vulnerability


vendor: tuxera

product: fedora

summary: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.

title: Tuxera Ntfs-3G security vulnerability


summary: NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root.

title: Tuxera Ntfs-3G security vulnerability


summary: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.

title: Tuxera Ntfs-3G security vulnerability


summary: NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.

title: Tuxera Ntfs-3G security vulnerability


summary: SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, and ID parameters to search.php.

title: Atoms183 Cms Project Atoms183 Cms security vulnerability


product: cms-php

summary: SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1.


summary: File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page.

title: Balero Cms Project Balero Cms security vulnerability


vendor: ptcl

summary: An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path.

title: Ptcl Hg150-Ub Firmware security vulnerability


vendor: scalabium

summary: Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.

title: Scalabium Dbase Viewer security vulnerability


product: zammad

vendor: zammad

summary: Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information.

title: Zammad security vulnerability


summary: Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.

title: Zammad security vulnerability


summary: Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page.

title: Zammad security vulnerability


summary: Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view.

title: Zammad security vulnerability


summary: Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information.


summary: Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.

title: Zammad security vulnerability


vendor: axiosys

summary: An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS).


summary: An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).


vendor: samsung

summary: An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.


vendor: gestionaleamica

summary: A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be executed with "LocalSystem" privileges.


product: bludit

vendor: bludit

summary: Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.


vendor: totolink

summary: A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.

title: Totolink A720R Firmware security vulnerability


summary: A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).


summary: A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request.


summary: A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request.


product: tcl

vendor: tcl

summary: In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding


vendor: tieline

summary: Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account.


summary: Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.


product: useradm

summary: The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).

title: Northern.Tech Useradm security vulnerability


product: seeddms

vendor: seeddms

summary: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.

title: Seeddms security vulnerability


product: tsmuxer

summary: tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.


summary: tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_set(int) in hevc.cpp.

title: Tsmuxer Project Tsmuxer security vulnerability


product: dotcms

vendor: dotcms

summary: A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' and 'Filename' parameters.

title: Dotcms security vulnerability


summary: A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.

title: Dotcms security vulnerability


summary: A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.

title: Dotcms security vulnerability


vendor: owasp

vendor: fedoraproject

vendor: debian

summary: OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.

title: Owasp Owasp Modsecurity Core Rule Set security vulnerability


product: imcat

vendor: txjia

summary: Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filtering_get_contents function.

title: Txjia Imcat security vulnerability


summary: An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.


product: vicidial

vendor: vicidial

summary: Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.

title: Vicidial security vulnerability


vendor: solari

summary: A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).

title: Solari Termtalk Server security vulnerability


vendor: phpgurukul

summary: Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.


summary: Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.


product: deskpro

vendor: deskpro

summary: Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL.

title: Deskpro security vulnerability


vendor: realtek

summary: Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header.


summary: Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.


business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The authoritative sources identify affected ranges and patch package names but do not establish one universal fixed SDK version for every supported branch.

uncertainty: Realtek's advisory covers multiple SDK projects and CVEs; it does not provide a CVE-specific, branch-independent version threshold that can be used as a universal fixed_version.

uncertainty: The returned authoritative sources do not provide a precise, safe runtime verification procedure or a guaranteed product-level firmware mapping.

uncertainty: The NVD record's current affected CPE data and the Realtek advisory's branch-specific patch archive names should not be treated as proof that every downstream device vendor has incorporated the fix.

product: Jungle Software Development Kit (SDK)

vendor_project: Realtek

vulnerability_name: Realtek Jungle SDK Remote Code Execution Vulnerability

summary: Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.


business_risk: Critical network-reachable vulnerability in the Realtek AP-Router SDK HTTP management server. NVD describes potential remote arbitrary code execution, while Realtek’s advisory specifically confirms multiple buffer overflows in the boa server that can cause service crashes and denial of service.

claim: The affected product is the Realtek AP-Router SDK, including rtl819x-SDK v3.2.x, v3.4.x, v3.4T, v3.4T-CT, and rtl819x-eCos v1.5.x series.

claim: NVD identifies Realtek Jungle SDK versions from 2.0 through 3.4.14b as affected.

claim: The vulnerability affects the boa HTTP web server and can be triggered through crafted requests containing overly long or invalid form parameters, including submit-url, ifname, hostname, and peerPin.

claim: NVD describes the management interface as network accessible and states that successful exploitation may allow remote arbitrary code execution, depending on the end-vendor integration.

claim: Realtek lists CVE-2021-35395 patches for SDK v3.2.3, SDK v3.4.11, SDK v3.4T-CT, and rtl819x-eCos v1.5.3.

claim: The vendor remediation is to apply the listed boa buffer-overflow patch package appropriate to the deployed SDK branch.

kind: remediation

claim: Verification should be based on confirming that the deployed firmware or SDK incorporates the applicable vendor-listed patch; the advisory does not define a safe active test procedure.

claim: CISA lists CVE-2021-35395 as the Realtek AP-Router SDK Buffer Overflow Vulnerability and associates it with CWE-20 and CWE-122.

exposure_conditions: The device incorporates an affected Realtek AP-Router/Jungle SDK release, including the rtl819x-SDK v3.2.x, v3.4.x, v3.4T, v3.4T-CT, or rtl819x-eCos v1.5.x series.

exposure_conditions: The affected HTTP management server is the boa implementation and is reachable over the network.

exposure_conditions: An attacker can submit a crafted request containing overly long or invalid form parameters such as submit-url, ifname, hostname, or peerPin.

recipe_specificity: specific

remediation_steps: Apply the vendor-provided CVE-2021-35395 boa buffer-overflow patch appropriate to the SDK branch.

remediation_steps: For SDK v3.2.x, use the vendor-listed 20210608_release_v3.2.3_patch_for_fix_buffer_overflow_of_boa.tar.gz patch.

remediation_steps: For SDK v3.4.x, use the vendor-listed 20210608_release_v3.4.11_patch_for_fix_buffer_overflow_of_boa.tar.gz patch.

remediation_steps: For SDK v3.4T-CT, use the vendor-listed 20210608_release_v3.4T-CT_patch_for_fix_buffer_overflow_of_boa.tar.gz patch.

remediation_steps: For rtl819x-eCos v1.5.x deployments, use the vendor-listed 20210701_ecosV1.5.3_patch_for_fixing_vulnerabiits.tar.gz patch.

remediation_steps: Coordinate with the device manufacturer because downstream firmware may integrate or modify the Realtek SDK and may require a manufacturer-specific firmware update.

uncertainty: The vendor advisory identifies patch packages and SDK branches but does not provide a universal downstream firmware-version mapping.

uncertainty: NVD describes possible arbitrary code execution, whereas Realtek’s advisory characterizes the documented CVE-2021-35395 impact as server crash and denial of service; actual impact depends on the vendor’s SDK integration and exposed features.

uncertainty: The current NVD weakness field is listed as Other; CISA associates this CVE with CWE-20 and CWE-122.

verification_steps: Review the deployed firmware or SDK component inventory and confirm that the applicable Realtek CVE-2021-35395 patch is included.

verification_steps: Confirm with the device manufacturer that the released firmware incorporates the applicable boa buffer-overflow fix.

verification_steps: Do not validate by submitting malformed or oversized management-server parameters to a production device.

product: AP-Router SDK

author: Codex

description: CVE-2021-35395 is CISA KEV Realtek leftover. NVD CPE last-affects including 3.4.14b from 2.0. Vendor boa patches are not an NVD first_patched.

maturity: development

title: CVE-2021-35395: Realtek AP-Router SDK buffer overflow

recipe_kind: markdown-draft

summary: Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver.


product: drogon

vendor: drogon

summary: A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read files. The vulnerability is due to lack of proper input validation for requested path. An attacker could exploit this vulnerability by sending crafted HTTP request with specific path to read. Successful exploitation could allow the attacker to read files that should be restricted.

title: Drogon security vulnerability


vendor: PROLiNK

status: Deferred

summary: PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status).

title: Prolink Prc2402M security vulnerability


vendor: chamilo

summary: A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.

title: Chamilo Chamilo Lms security vulnerability


summary: Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.


summary: A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields.


product: lmxcms

vendor: lmxcms

summary: SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.


product: phpipam

vendor: phpipam

summary: phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.


product: smashing

summary: Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL's for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.


vendor: remotemouse

summary: Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to navigate to cmd.exe. It binds to local ports to listen for incoming connections.

title: Remotemouse Emote Interactive Studio security vulnerability


vendor: lexmark

summary: The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing during the add printer process, resulting in escalation of privileges to SYSTEM.

title: Lexmark G2 Driver security vulnerability


vendor: entando

summary: A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute

title: Entando Admin Console security vulnerability


vendor: teradici

summary: In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web application.

title: Teradici Pcoip Management Console security vulnerability


vendor: struktur

summary: An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.


summary: Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload


summary: Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter.


vendor: liferay

summary: Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.

title: Liferay Liferay Portal security vulnerability


business_risk: Critical unauthenticated remote-code-execution risk affecting ForgeRock Access Management/OpenAM. Exploitation can provide complete impact to confidentiality, integrity, and availability, and the vulnerability has been listed in CISA's Known Exploited Vulnerabilities catalog. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-35464?utm_source=openai))

claim: NVD identifies ForgeRock Access Management and OpenAM as affected products for CVE-2021-35464.

claim: NVD lists ForgeRock Access Management versions before 6.5.4 and OpenAM versions from 9.0.0 through versions before 14.6.3 as affected ranges.

claim: Australian government guidance documents active exploitation of vulnerable internet-accessible ForgeRock AM/OpenAM servers and describes unauthenticated remote code execution.

claim: The NVD affected-range boundaries support version 6.5.4 or later for the listed ForgeRock Access Management range and version 14.6.3 or later for the listed OpenAM range; separate government guidance recommends OpenAM version 7.

claim: Government guidance recommends updating OpenAM to version 7 or applying the workaround identified in ForgeRock Security Advisory #202104; if neither is possible, isolate the service from the Internet or shut it down.

claim: Government guidance recommends reviewing systems and networks for vulnerable instances and provides advice for identifying potential successful exploitation.

exposure_conditions: ForgeRock Access Management or OpenAM is deployed in an affected version range.

exposure_conditions: The server is reachable by an attacker over the network; government guidance specifically identifies internet-accessible vulnerable servers as being targeted. ([cyber.gov.au](https://www.cyber.gov.au/about-us/advisories/advisory-2021-004-active-exploitation-forgerock-access-manager-openam-servers?utm_source=openai))

exposure_conditions: The affected JATO-based request-processing functionality is available to the attacker. Exact deployment-specific endpoint exposure should be confirmed from vendor documentation and configuration.

remediation_steps: Upgrade ForgeRock Access Management 6.5.x deployments to version 6.5.4 or later, based on the NVD affected-range boundary. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-35464?utm_source=openai))

remediation_steps: For OpenAM deployments in the NVD-listed 9.0.0 through 14.6.2 range, upgrade to version 14.6.3 or later; government guidance also recommends updating OpenAM to version 7. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-35464?utm_source=openai))

remediation_steps: If immediate upgrade is not possible, apply the workaround specified in ForgeRock Security Advisory #202104. The exact workaround details were not available in the returned authoritative page content, so do not infer configuration changes from this record. ([cyber.gov.au](https://www.cyber.gov.au/about-us/advisories/advisory-2021-004-active-exploitation-forgerock-access-manager-openam-servers?utm_source=openai))

remediation_steps: Until remediation is applied, restrict the affected service from Internet exposure using existing approved network controls, or isolate/shut down the server where operationally feasible. ([cyber.gov.au](https://www.cyber.gov.au/about-us/alerts/forgerock-open-am-critical-vulnerability?utm_source=openai))

remediation_steps: Because active exploitation has been reported, review authentication, application, network, and host telemetry for suspicious activity before and after remediation. Do not treat patching alone as evidence that prior compromise did not occur. ([cyber.gov.au](https://www.cyber.gov.au/about-us/advisories/advisory-2021-004-active-exploitation-forgerock-access-manager-openam-servers?utm_source=openai))

uncertainty: The supplied record contains a generic MITRE affected entry with product/version n/a, while NVD provides the actionable ForgeRock AM/OpenAM CPE ranges; the NVD ranges were used for version enrichment. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-35464?utm_source=openai))

uncertainty: The supplied summary says ForgeRock AM is vulnerable before 7.0, whereas NVD lists AM versions below 6.5.4 and OpenAM versions from 9.0.0 below 14.6.3. Product naming and upgrade-path differences should be resolved against the deployment's official ForgeRock support documentation.

uncertainty: The original ForgeRock advisory page was not returned with its detailed contents, so specific workaround configuration, package names, and vendor-specific validation procedures are intentionally omitted.

uncertainty: A version check and network-exposure review establish configuration status but do not prove that exploitation has or has not occurred.

verification_steps: Inventory the installed ForgeRock AM/OpenAM product and exact version on each deployment; compare it with the fixed-version boundaries above.

verification_steps: Confirm that all production instances, standby nodes, and replicated administrative components meet the applicable fixed-version boundary.

verification_steps: Verify through approved network-inventory or firewall records that Internet access is removed or restricted for any instance that cannot yet be upgraded. ([cyber.gov.au](https://www.cyber.gov.au/about-us/alerts/forgerock-open-am-critical-vulnerability?utm_source=openai))

verification_steps: After upgrade or workaround deployment, perform a normal authenticated administrative health check and review application logs for errors. Do not send exploit payloads or conduct destructive production testing.

verification_steps: Confirm that monitoring and incident-response review has been completed for potentially exposed instances, given the documented active exploitation. ([cyber.gov.au](https://www.cyber.gov.au/about-us/advisories/advisory-2021-004-active-exploitation-forgerock-access-manager-openam-servers?utm_source=openai))

product: Access Management (AM)

vendor_project: ForgeRock

vulnerability_name: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

vendor: forgerock

product: openam

summary: ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier


summary: The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry that has an unquoted service path.

title: Lexmark Printer Software G2 security vulnerability


vendor: lemonldap-ng

vendor: debian

summary: An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users.


product: lemonldap-ng

summary: An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.


product: Apache Traffic Server

vendor: Apache Software Foundation

vendor: apache

summary: Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.


vendor: sas

summary: SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.


vendor: linux

product: fedora

vendor: fedoraproject

summary: In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.

title: Linux Linux Kernel security vulnerability


vendor: nagios

summary: Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.


summary: Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.

title: Nagios Log Server security vulnerability


vendor: barco

summary: An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution (with user privileges of the local user) on any device that tries to connect to a WePresent presentation system.


product: impact

vendor: nokia

summary: The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.

title: Nokia Impact security vulnerability


summary: Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTTP GET parameter. This allows an attacker to access sensitive data from the database and obtain access to the database user, database name, and database version information.

title: Nokia Impact security vulnerability


summary: The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload server-side executable files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one.

title: Nokia Impact security vulnerability


summary: A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.

title: Nokia Impact Mobile security vulnerability


summary: Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts page) via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user, database name, and database version information, and potentially database data.

title: Nokia Broadcast Message Center security vulnerability


product: thruk

vendor: thruk

summary: Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.


summary: Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

title: Thruk security vulnerability


summary: Thruk before 2.44 allows XSS for a quick command.


vendor: wowza

summary: A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolved in Wowza Streaming Engine release 4.8.14.

title: Wowza Streaming Engine security vulnerability


summary: Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager/server/vhost/historical.jsdata vhost parameter. This is due to the insufficient management of available filesystem resources. An attacker could exploit this vulnerability through the Virtual Host Monitoring section by requesting random virtual-host historical data and exhausting available filesystem resources. A successful exploit could allow the attacker to cause database errors and cause the device to become unresponsive to web-based management. (Manual intervention is required to free filesystem resources and return the application to an operational state.)


product: TIBCO WebFOCUS Client

vendor: TIBCO Software Inc.

product: TIBCO WebFOCUS Installer

product: TIBCO WebFOCUS Reporting Server

vendor: tibco

summary: The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO WebFOCUS Client: versions 8207.27.0 and below, TIBCO WebFOCUS Installer: versions 8207.27.0 and below, and TIBCO WebFOCUS Reporting Server: versions 8207.27.0 and below.

title: Tibco Webfocus Client security vulnerability


product: TIBCO JasperReports Server

summary: The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

title: Tibco Jasperreports Server security vulnerability


summary: The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.


summary: The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.


product: TIBCO ActiveSpaces - Community Edition

product: TIBCO ActiveSpaces - Developer Edition

product: TIBCO ActiveSpaces - Enterprise Edition

product: TIBCO FTL - Community Edition

product: TIBCO FTL - Developer Edition

product: TIBCO FTL - Enterprise Edition

product: TIBCO eFTL - Community Edition

product: TIBCO eFTL - Developer Edition

product: TIBCO eFTL - Enterprise Edition

product: activespaces

summary: The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges.

title: Tibco Activespaces security vulnerability


product: TIBCO EBX

product: ebx

summary: The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.

title: Tibco Ebx security vulnerability


product: TIBCO Nimbus

product: nimbus

summary: The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.4.0 and below.

title: Tibco Nimbus security vulnerability


product: TIBCO Data Virtualization

summary: The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.

title: Tibco Data Virtualization security vulnerability


vendor: pandorafms

summary: PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.


product: misp

vendor: misp-project

summary: app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.

title: Misp-Project Misp security vulnerability


product: filerun

vendor: afian

summary: Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.


summary: Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.


summary: Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.


summary: Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.

title: Afian Filerun security vulnerability


product: aquariusnet

vendor: terarecon

summary: NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exploit this, a low-privileged user must change the service configuration or overwrite the binary service.

title: Terarecon Aquariusnet security vulnerability


vendor: zohocorp

summary: An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.


product: mermaid

summary: Mermaid before 8.11.0 allows XSS when the antiscript feature is used.


product: narou

summary: Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.


product: Apache Commons Compress

vendor: Apache Software Foundation

less_than: Apache Commons Compress*

vendor: netapp

vendor: oracle

summary: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.


vendor: apache

summary: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

title: Apache Commons Compress security vulnerability


summary: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.


vendor: idemia

summary: A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate authenticated attackers to achieve code execution, denial of services, and information disclosure via serial ports.

title: Idemia Morphowave Compact Mdpi Firmware security vulnerability


summary: A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets.


summary: A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, and MA VP MD devices before 4.9.7 allows remote attackers to achieve code execution, denial of services, and information disclosure via TCP/IP packets.


product: openvpn-client

vendor: securepoint

summary: Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.

title: Securepoint Openvpn-Client security vulnerability


product: postsrsd

summary: PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."

title: Postsrsd Project Postsrsd security vulnerability


product: System Data Manager – SDM600

vendor: Hitachi ABB Power Grids

less_than: FP2 HF6

vendor: hitachiabb-powergrids

summary: Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 (Build Nr. 1.2.14002.257).

title: Hitachiabb-Powergrids Sdm600 Firmware security vulnerability


product: eSOMS

product: esoms

vendor: hitachienergy

summary: Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials that are stored by the browser. This issue affects: Hitachi ABB Power Grids eSOMS version 6.3 and prior versions.

title: Hitachienergy Esoms security vulnerability