product: PingFederate

vendor: Ping Identity

status: affected

version_type: custom

ecosystem: software/application

metric_type: Primary

severity: medium

metric_type: Secondary

severity: low

part: a

product: pingfederate

vendor: pingidentity

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

title: Pingidentity Pingfederate security vulnerability


platforms:
Windows
macOS X

product: PingID Desktop

version: unspecified

archetype: generic

severity: critical

severity: high

summary: PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.


vendor: zohocorp

summary: Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.


product: gclib

summary: An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted GFF file.

title: Gclib Project Gclib security vulnerability


ecosystem: linux/kernel

part: o

vendor: linux

vendor: netapp

summary: The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.


product: Apache Traffic Control

vendor: Apache Software Foundation

less_than: Apache Traffic Control*

vendor: apache

summary: An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.

title: Apache Traffic Control security vulnerability


product: Apache Heron (Incubating)

version: Apache Heron 0.20.4-incubating

product: heron

summary: Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.


product: Trend Micro Apex One

vendor: Trend Micro

vendor: trendmicro

summary: An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

title: Trendmicro Apex One security vulnerability


product: Trend Micro Worry-Free Business Security

summary: A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


product: Apache HTTP Server

version: Apache HTTP Server 2.4.49

version: Apache HTTP Server 2.4.50

business_risk: Critical risk for Apache HTTP Server 2.4.49 or 2.4.50 exposed to untrusted HTTP requests. Successful exploitation can enable path traversal and file access outside Alias-like configured directories; where CGI is enabled for those aliased paths, the issue may allow remote code execution. The Apache project states that earlier Apache HTTP Server versions are not affected by this CVE.

claim: Apache HTTP Server is affected by CVE-2021-42013.

claim: The Apache project identifies Apache HTTP Server 2.4.49 and 2.4.50 as affected, and states that earlier versions are not affected by this CVE.

claim: The issue can map URLs to files outside directories configured by Alias-like directives; exploitation can succeed when those files are not protected by the usual default authorization rule requiring access denial. CGI enabled for aliased paths can permit remote code execution.

kind: exposure

claim: Apache HTTP Server 2.4.51 is listed as the release fixing CVE-2021-42013.

claim: The Apache project recommends upgrading to a release containing the fix; the fix was applied in the 2.4.x development line and released as Apache HTTP Server 2.4.51.

kind: remediation

claim: A safe version-based verification can compare approved inventory of the deployed Apache HTTP Server against the affected versions 2.4.49 and 2.4.50 and the fixed release 2.4.51.

kind: verification

exposure_conditions: The deployed product is Apache HTTP Server version 2.4.49 or 2.4.50.

exposure_conditions: The server accepts attacker-controlled HTTP requests.

exposure_conditions: Files outside the relevant Alias-like directories are not protected by the usual default authorization rule requiring access denial.

exposure_conditions: CGI scripts are enabled for the affected aliased paths; this condition is specifically associated with potential remote code execution.

recipe_specificity: specific

remediation_steps: Upgrade Apache HTTP Server to version 2.4.51 or later, preferably the latest vendor-supported release available for the operating system or distribution.

remediation_steps: For downstream or bundled products such as Oracle or NetApp offerings, follow the respective vendor advisory and verify that the bundled Apache component has been updated.

remediation_steps: Until upgrade, review Alias-like mappings, access-control rules, and CGI enablement; ensure sensitive files are denied by the applicable authorization policy and avoid enabling CGI on aliased paths unless required.

status: complete

uncertainty: The supplied record lists downstream Oracle, Fedora, and NetApp CPEs, but those product-specific fixes and backport versions were not independently established from the returned authoritative sources.

uncertainty: A version number alone may not prove that a distribution backport is present; vendor package metadata or an advisory is needed for downstream builds.

uncertainty: No active exploit or production-path probing should be used as a verification method.

verification_steps: Use approved asset or package inventory to identify the deployed Apache HTTP Server version without sending exploit requests.

verification_steps: Confirm the reported version is not 2.4.49 or 2.4.50 and is at least 2.4.51, or confirm that the product vendor documents an equivalent backported fix.

verification_steps: Review the effective configuration for Alias-like mappings, authorization rules protecting files outside those mappings, and CGI enablement on aliased paths.

verification_steps: Confirm remediation through change-management or package records and, where applicable, the downstream vendor’s security bulletin.

known_ransomware_campaign_use: Known

product: HTTP Server

required_action: Apply updates per vendor instructions.

vendor_project: Apache

vulnerability_name: Apache HTTP Server Path Traversal Vulnerability

author: Codex

description: CVE-2021-42013 is CISA KEV Apache leftover. NVD exact-affects 2.4.49 and 2.4.50. Vendor names 2.4.51. 2.4.51 is not an NVD first_patched.

maturity: development

title: CVE-2021-42013: Apache HTTP Server 2.4.50 incomplete-fix bypass

product: fedora

vendor: fedoraproject

vendor: oracle

recipe_kind: markdown-draft

status: Analyzed

summary: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.


product: Mendix Applications using Mendix 7

vendor: Siemens

version: All versions < V7.23.26

product: Mendix Applications using Mendix 8

version: All versions < V8.18.12

product: Mendix Applications using Mendix 9

version: All versions < V9.6.1

product: mendix

vendor: mendix

summary: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (All versions < V8.18.12), Mendix Applications using Mendix 9 (All versions < V9.6.1). Applications built with affected versions of Mendix Studio Pro do not prevent file documents from being cached when files are opened or downloaded using a browser. This could allow a local attacker to read those documents by exploring the browser cache.

title: Mendix security vulnerability


default_status: unknown

product: RUGGEDCOM i800

product: RUGGEDCOM i801

product: RUGGEDCOM i802

product: RUGGEDCOM i803

product: RUGGEDCOM M2100

product: RUGGEDCOM M2100F

product: RUGGEDCOM M2200

product: RUGGEDCOM M2200F

product: RUGGEDCOM M969

product: RUGGEDCOM M969F

product: RUGGEDCOM RMC30

product: RUGGEDCOM RMC8388 V4.X

ecosystem: operating-system

vendor: siemens

summary: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RS…

title: Siemens Ruggedcom Ros security vulnerability


product: RUGGEDCOM i800NC

product: RUGGEDCOM i801NC

product: RUGGEDCOM i802NC

product: RUGGEDCOM i803NC

product: RUGGEDCOM M2100NC

summary: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS…


product: RUGGEDCOM i800

product: RUGGEDCOM M2200NC

summary: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X…


product: Siveillance Video DLNA Server

summary: A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video DLNA Server (2020 R1), Siveillance Video DLNA Server (2020 R2), Siveillance Video DLNA Server (2020 R3), Siveillance Video DLNA Server (2021 R1). The affected application contains a path traversal vulnerability that could allow to read arbitrary files on the server that are outside the application’s web document directory. An unauthenticated remote attacker could exploit this issue to access sensitive information for subsequent attacks.

title: Siemens Siveillance Video Management Software 2019 R1 security vulnerability


product: SIMATIC eaSie PCS 7 Skill Package

version: All versions < V21.00 SP3

summary: A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default.


product: ModelSim Simulation

version: All versions

product: Questa Simulation

product: modelsim

product: questa

summary: A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property (IP) data in accordance with the IEEE 1735 recommended practice. This could allow a sophisticated attacker to discover the keys, bypassing the protection intended by the IEEE 1735 recommended practice.


product: Simcenter STAR-CCM+ Viewer

version: All versions < 2021.3.1

summary: A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.


product: Mendix Applications using Mendix 8

version: All versions < V8.18.13

product: Mendix Applications using Mendix 9

version: All versions < V9.6.2

product: mendix

summary: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it.

title: Mendix security vulnerability


summary: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control read access for certain client actions. This could allow authenticated attackers to retrieve the changedDate attribute of arbitrary objects, even when they don't have read access to them.

title: Mendix security vulnerability


product: SINUMERIK Edge

version: All versions < V3.2

summary: A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and the intended server.


product: syngo fastView

vendor: siemens-healthineers

summary: A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14860)


product: SIMATIC STEP 7 (TIA Portal) V15

product: SIMATIC STEP 7 (TIA Portal) V16

version: All versions < V16 Update 5

product: SIMATIC STEP 7 (TIA Portal) V17

version: All versions < V17 Update 2

summary: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions < V17 Update 2). An attacker could achieve privilege escalation on the web server of certain devices due to improper access control vulnerability in the engineering system software. The attacker needs to have direct access to the impacted web server.

title: Siemens Simatic Step 7 security vulnerability


product: mediawiki

vendor: mediawiki

summary: An issue was discovered in MediaWiki through 1.36.2. A parser function related to loop control allowed for an infinite loop (and php-fpm hang) within the Loops extension because egLoopsCountLimit is mishandled. This could lead to memory exhaustion.


ecosystem: javascript/npm

summary: An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log.


summary: An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.


summary: An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text (a parameter to mediasearch-did-you-mean) was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the intitle: search operator within the query.


summary: An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.


summary: An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.


summary: An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.


summary: An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.


summary: An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.


summary: An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.


product: abantecart

vendor: abantecart

summary: An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.


summary: An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an XSS payload.


product: e-flow

vendor: ipesa

summary: IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter.

title: Ipesa E-Flow security vulnerability


product: unicorn

vendor: django-unicorn

summary: The Unicorn framework through 0.35.3 for Django allows XSS via component.name.


product: accel-ppp

vendor: accel-ppp

summary: ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.


vendor: asus

summary: ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker.


ecosystem: windows/system

vendor: thalesgroup

summary: Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.

title: Thalesgroup Safenet Authentication Client security vulnerability


vendor: obsidian

summary: Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases.


product: RUGGEDCOM APE1808 - BIOS

product: SIMATIC Field PG M5

product: SIMATIC Field PG M6

product: SIMATIC IPC127E

product: SIMATIC IPC227G

product: SIMATIC IPC277G

product: SIMATIC IPC277G PRO

product: SIMATIC IPC327G

product: SIMATIC IPC377G

product: SIMATIC IPC427E

product: SIMATIC IPC477E

vendor: insyde

summary: An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41, and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads toarbitrary code execution in UEFI DisplayTypeDxe DXE driver.

title: Insyde Insydeh2O security vulnerability


summary: An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.22. An Int15ServiceSmm SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

title: Insyde Insydeh2O security vulnerability


vendor: SAP SE

vendor: sap

summary: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.

title: Sap Businessobjects Business Intelligence Platform security vulnerability


product: SAP ERP HCM Portugal

summary: SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.

title: Sap Erp Human Capital Management security vulnerability


product: SAP Knowledge Warehouse

summary: A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.


product: SAP Commerce

ecosystem: java/maven

product: commerce

summary: If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.

title: Sap Commerce security vulnerability


product: SAP Business One

summary: SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but once exploited the attacker may be able to completely compromise confidentiality, integrity, and availability of the application.

title: Sap Business One security vulnerability


summary: In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.

title: Sap Netweaver Abap security vulnerability


product: SAP 3D Visual Enterprise Viewer

summary: When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.

title: Sap 3D Visual Enterprise Viewer security vulnerability


summary: When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application


summary: When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application


vendor: visual-tools

summary: In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.

title: Visual-Tools Dvr Vx16 Firmware security vulnerability


product: barrier

product: fedora

vendor: fedoraproject

summary: An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficiently verify the identify of connecting clients. Clients can thus exploit weaknesses in the provided protocol to cause denial-of-service or stage further attacks that could lead to information leaks or integrity corruption.


summary: An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could instead be guessed from hostnames or other publicly available information. In the active session state, an attacker can capture input device events from the server, and also modify the clipboard content on the server.


summary: An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka the server-side implementation of Barrier) by quickly opening and closing TCP connections while sending a Hello message for each TCP session.


summary: An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly close file descriptors for established TCP connections. An unauthenticated remote attacker can thus cause file descriptor exhaustion in the server process, leading to denial of service.


summary: An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side implementation of Barrier) and barrierc by sending long TCP messages.


vendor: kaysongroup

summary: PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.


summary: PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the site.

title: Php Event Calendar Project Php Event Calendar security vulnerability


platforms: Windows Linux

product: QuantaStor

vendor: OSNEXUS

version_type: semver

archetype: ssrf

product: quantastor

vendor: osnexus

summary: An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests.


summary: An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>


summary: An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al


summary: Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'


summary: An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.


product: zammad

vendor: zammad

summary: An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service.


summary: An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.


summary: An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request.


summary: An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API.


summary: An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.


summary: An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.


summary: An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.


summary: An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.


summary: An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.


summary: An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers.


summary: An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.


product: xshell

vendor: netsarang

summary: Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.


product: mailman

vendor: gnu

vendor: debian

summary: GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.


summary: GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).


product: Remote Desktop Manager

vendor: Devolutions

vendor: devolutions

summary: An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell.

title: Devolutions Remote Desktop Manager security vulnerability


vendor: zohocorp

summary: Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.


product: Trend Micro Apex One

vendor: Trend Micro

vendor: trendmicro

summary: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42103.


summary: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


summary: An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42101.


product: Trend Micro Worry-Free Business Security

version: 10.0 SP1, Services (SaaS)

summary: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42105, 42106 and 42107.


summary: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42106 and 42107.


summary: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42105 and 42107.


summary: Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-42104, 42105 and 42106.


summary: Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


vendor: vitec

summary: VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.


product: allegro

vendor: allegro

summary: An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is installed, because of DLL hijacking.


vendor: rcdevs

summary: An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed on a jailbroken device, it is possible to retrieve the PIN code used to access the application. The IOS app version 1.4.1631262629 resolves this issue by storing a hash PIN code.


product: limesurvey

vendor: limesurvey

summary: The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.

title: Limesurvey security vulnerability


product: RUGGEDCOM APE1808 - BIOS

vendor: Siemens

product: SIMATIC Field PG M5

product: SIMATIC Field PG M6

product: SIMATIC IPC127E

product: SIMATIC IPC227G

product: SIMATIC IPC277G

product: SIMATIC IPC277G PRO

product: SIMATIC IPC327G

product: SIMATIC IPC377G

product: SIMATIC IPC427E

product: SIMATIC IPC477E

vendor: insyde

summary: An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

title: Insyde Insydeh2O security vulnerability


product: Micron ddr4_sdram

vendor: Micron

product: Samsung ddr4_sdram

vendor: Samsung

product: SK Hynix ddr4_sdram

vendor: SK Hynix

product: Micron lpddr4

product: Samsung lpddr4

product: SK Hynix lpddr4

vendor: samsung

vendor: micron

vendor: skhynix

summary: Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer access patterns, consisting of aggressors with different frequencies, phases, and amplitudes allow triggering bit flips on affected memory modules using our Blacksmith fuzzer. The patterns generated by Blacksmith were able to trigger bitflips on all 40 PC-DDR4 DRAM devices in our test pool, which cover the three major DRAM manufacturers: Samsung, SK Hynix, and Micron. This means that, even when chips advertised as Rowhammer-free are used, attackers may still be able to exploit Rowhammer. For example, this enables privilege-escalation attacks against the kernel or binaries such as the sudo binary, and also triggering bit flips in RSA-2048 keys (e.g., SSH keys) to gain cross-tenant virtual-machine access. We can confirm that DRAM devices acquired in July 2020 with DRAM chips from all three major DRAM vendors (Samsung, SK Hynix, Micron) are affected by this vulnerability. For more details, please refer to our publication.

title: Samsung Ddr4 Sdram Firmware security vulnerability


product: TopEase

vendor: Business-DNA Solutions GmbH

product: topease

vendor: businessdnasolutions

summary: Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.

title: Businessdnasolutions Topease security vulnerability


summary: Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the front-end source code or other means.


summary: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution.


summary: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.


summary: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.


summary: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion of the underlying resource.


summary: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads to breaking the object page that the date field is present.


summary: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the affected attribute non-editable.


summary: Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enabling client-side attacks.


product: Ivanti Avalanche

product: avalanche

vendor: ivanti

summary: An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover.

title: Ivanti Avalanche security vulnerability


product: Ivanti Avalance

summary: An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.

title: Ivanti Avalanche security vulnerability


summary: An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.

title: Ivanti Avalanche security vulnerability


summary: A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.

title: Ivanti Avalanche security vulnerability


summary: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service.

title: Ivanti Avalanche security vulnerability


summary: A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.

title: Ivanti Avalanche security vulnerability


summary: A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution.

title: Ivanti Avalanche security vulnerability


summary: A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.

title: Ivanti Avalanche security vulnerability


summary: A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.

title: Ivanti Avalanche security vulnerability


summary: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.

title: Ivanti Avalanche security vulnerability


product: unicorn

vendor: django-unicorn

summary: The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.


product: vault

vendor: hashicorp

summary: HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

title: Hashicorp Vault security vulnerability


product: redcap

vendor: vanderbilt

summary: A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.

title: Vanderbilt Redcap security vulnerability


product: zammad

vendor: zammad

summary: An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc.


product: Safenet Authentication Service

vendor: Thales CPL

version: Windows Logon Agent

vendor: thalesgroup

summary: A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.

title: Thalesgroup Safenet Windows Logon Agent security vulnerability


vendor: deno

summary: Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.


product: tinydtls

vendor: contiki-ng

summary: An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of service.


summary: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops.


summary: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.


summary: Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_decrypt_message().

title: Contiki-Ng Contiki-Ng Tinydtls security vulnerability


summary: An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service.

title: Contiki-Ng Tinydtls security vulnerability


summary: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).


summary: Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denial of service via crafted data packet.


vendor: mitrastar

summary: MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path".

title: Mitrastar Gpt-2541Gnac-N1 Firmware security vulnerability


summary: Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESID or other unspecified impacts via the fullname parameter to the login_registration page.

title: Try My Recipe Project Try My Recipe security vulnerability


summary: The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.

title: Simple Payroll System With Dynamic Tax Bracket Project Simple Payroll S… security vulnerability


product: zenario

vendor: tribalsystems

summary: Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.


product: masacms

vendor: masacms

summary: MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.


product: wdja

vendor: wdja

summary: wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function.


product: konga

summary: Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.


product: nopcommerce

vendor: nopcommerce

summary: nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires.


archetype: xxe

product: eyoucms

vendor: eyoucms

summary: The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.

title: Eyoucms security vulnerability


product: swftools

vendor: swftools

summary: An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function handleEditText() located in swfdump.c. It allows an attacker to cause code Execution.


summary: An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traits_parse() located in abc.c. It allows an attacker to cause Denial of Service.


summary: An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. It allows an attacker to cause code execution.


summary: An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_GetBits() located in rfxswf.c. It allows an attacker to cause Denial of Service.


summary: An issue was discovered in swftools through 20201222. A heap buffer overflow exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.


summary: An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function main() located in swfdump.c. It allows an attacker to cause Denial of Service.


summary: An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetD64() located in rfxswf.c. It allows an attacker to cause code execution.


summary: An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_DeleteFilter() located in swffilter.c. It allows an attacker to cause Denial of Service.


summary: An issue was discovered in swftools through 20201222. A heap-use-after-free exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.


summary: An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetBits() located in rfxswf.c. It allows an attacker to cause code execution.


vendor: lenovo

summary: ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice.

title: Lenovo Elan Miniport Touchpad Driver security vulnerability


product: anonaddy

vendor: anonaddy

summary: A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.


vendor: rice

summary: OMPL v1.5.2 contains a memory leak in VFRRT.cpp


vendor: ethereum

summary: Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.

title: Ethereum Go Ethereum security vulnerability


product: dolibarr

vendor: dolibarr

summary: A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.


vendor: phpgurukul

summary: Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.


summary: SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.


product: kindeditor

vendor: kindsoft

summary: Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).

title: Kindsoft Kindeditor security vulnerability


summary: A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.


vendor: seowonintech

summary: Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter.


vendor: tp-link

summary: TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking part of the received data packet as part of the command. This will cause an attacker to execute arbitrary commands on the router.


summary: The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur.


product: osticket

vendor: enhancesoft

summary: SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.

title: Enhancesoft Osticket security vulnerability


business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The vendor advisory provides remediation paths but does not define one universal fixed version for every affected Sitecore XP branch.

uncertainty: The supplied NVD product list is truncated; the complete affected-version set should be taken from the Sitecore advisory rather than inferred from the truncated CPE list.

uncertainty: The returned authoritative sources do not provide a formal post-remediation validation procedure or release-specific patch identifiers.

uncertainty: The vendor advisory describes Internet exposure as applicable to affected systems but does not establish the actual exposure status of any particular deployment.

product: XP

vendor_project: Sitecore

vulnerability_name: Sitecore XP Remote Command Execution Vulnerability

description: CVE-2021-42237 is unauthenticated insecure deserialization on Sitecore XP. GHSA-j3x5-fr4h-9v7v last-names 7.5 Initial Release through 8.2 Update-7. Do not invent 8.2 Update-8.

model: GPT 5.5 Extra High reasoning

title: CVE-2021-42237: Sitecore XP Deserialization, 7.5 through 8.2 U7

vendor: sitecore

summary: Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.


vendor: jflyfox

summary: A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.


product: notimoo

summary: A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted title or message in a notification.

title: Notimoo Project Notimoo security vulnerability


product: flatcore-cms

vendor: flatcore

summary: FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.


product: Apache Superset

vendor: Apache Software Foundation

version: Apache Superset

product: superset

vendor: apache

summary: Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

title: Improper output neutralization for Logs


vendor: netapp

vendor: linux

summary: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.


vendor: beyondtrust

summary: BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.


product: appguard

vendor: blueplanet-works

summary: AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user.


summary: check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path (the /dev/bus substring and a number), aka an unanchored regular expression.

title: Check Smart Project Check Smart security vulnerability


product: BillQuick Web Suite

vendor_project: BQE

vulnerability_name: BQE BillQuick Web Suite SQL Injection Vulnerability

vendor: bqe

summary: BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.


product: tinyxml

vendor: debian

summary: TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.


vendor: revisorlab

summary: Revisor Video Management System (VMS) before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of sensitive data on the vulnerable server.


vendor: softing

summary: An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the OPC/UA client crash due to an out-of-memory condition.


product: Premiere

vendor: Adobe

version: unspecified

vendor: adobe

summary: Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


title: Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file


default_status: affected

product: Premiere Pro

summary: Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Premiere Pro security vulnerability


product: Animate

product: animate

summary: Adobe Animate version 21.0.9 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious FLA file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

title: Adobe Animate security vulnerability


title: Adobe Animate security vulnerability


summary: Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Animate security vulnerability


summary: Adobe Animate version 21.0.9 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed FLA file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Animate security vulnerability


summary: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.

title: Adobe Animate security vulnerability


summary: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.

title: Adobe Animate security vulnerability


product: Windows 10 Version 1607

vendor: Microsoft

product: Windows 10 Version 1809

product: Windows 10 Version 2004

product: Windows 10 Version 21H1

product: Windows 11 version 21H2

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

product: Windows Server version 2004

product: Windows Server version 20H2

vendor: microsoft

summary: Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability


platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1507

platforms:
32-bit Systems
x64-based Systems
ARM64-based Systems

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 1909

platforms:
32-bit Systems
ARM64-based Systems

product: Windows 10 Version 20H2

product: Windows 7

product: Windows 7 Service Pack 1

product: Windows 8.1

product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

summary: Microsoft COM for Windows Remote Code Execution Vulnerability


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 2004

product: Windows 10 Version 21H1

platforms:
ARM64-based Systems
x64-based Systems

summary: Microsoft Windows Media Foundation Remote Code Execution Vulnerability


product: Microsoft Visual Studio 2015 Update 3

product: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

product: Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

product: Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)

product: Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)

summary: Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability


product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Active Directory

vendor_project: Microsoft

vulnerability_name: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

summary: Active Directory Domain Services Elevation of Privilege Vulnerability


product: ChakraCore

product: Windows 10 Version 1507

product: Windows 10 Version 1607

platforms:
ARM64-based Systems
32-bit Systems
x64-based Systems

product: Windows 10 Version 1809

product: Windows 10 Version 1909

product: Windows 10 Version 2004

product: Windows 10 Version 20H2

product: Windows 10 Version 21H1

product: Windows 11 version 21H2

product: Windows Server 2022

summary: Chakra Scripting Engine Memory Corruption Vulnerability


summary: Windows Feedback Hub Elevation of Privilege Vulnerability


product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

title: Active Directory Domain Services Elevation of Privilege Vulnerability


product: Windows 7

product: Windows 7 Service Pack 1

product: Windows 8.1

summary: NTFS Elevation of Privilege Vulnerability


product: Windows 10 Version 1507

product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows Server 2012 R2 (Server Core installation)

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

summary: Windows Hyper-V Denial of Service Vulnerability


product: Windows 10 Version 1909

product: Windows 10 Version 2004

product: Windows 10 Version 20H2

product: Windows 10 Version 21H1

product: Windows 11 version 21H2

summary: Windows Kernel Elevation of Privilege Vulnerability


product: Windows Server version 2004

product: Windows Server version 20H2

summary: Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability


product: Windows Server 2008 R2 Service Pack 1

product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)

product: Windows Server 2008 Service Pack 2

product: Windows Server 2008 Service Pack 2 (Server Core installation)

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2019

product: Windows Server 2019 (Server Core installation)

product: Active Directory

title: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability


product: Windows 10 Version 1809

product: Windows 10 Version 1909

summary: Windows Hello Security Feature Bypass Vulnerability


product: Microsoft 365 Apps for Enterprise

product: Microsoft Excel 2013 Service Pack 1

product: Microsoft Excel 2016

product: Microsoft Office 2013 Service Pack 1

product: Microsoft Office 2016

product: Microsoft Office 2019

product: Microsoft Office 2019 for Mac

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC for Mac 2021

known_ransomware_campaign_use: Unknown

product: Office

vulnerability_name: Microsoft Excel Security Feature Bypass

product: excel

product: office

summary: Microsoft Excel Security Feature Bypass Vulnerability

title: Microsoft Excel Security Feature Bypass


platforms:
x64-based Systems
32-bit Systems

summary: Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability


product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Enterprise Server 2013 Service Pack 1

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

product: SharePoint Server Subscription Edition Language Pack

product: Microsoft SharePoint Foundation 2013 Service Pack 1

summary: Microsoft SharePoint Server Remote Code Execution Vulnerability


product: Microsoft 365 Apps for Enterprise

summary: Visual Basic for Applications Information Disclosure Vulnerability


summary: Microsoft Word Remote Code Execution Vulnerability


product: Windows Update Assistant

less_than: publication

summary: Windows 10 Update Assistant Elevation of Privilege Vulnerability


product: Microsoft Malware Protection Engine

summary: Microsoft Defender Remote Code Execution Vulnerability


product: Microsoft Surface Pro 3

summary: Microsoft Surface Pro 3 Security Feature Bypass Vulnerability


product: Azure Sphere

summary: Azure Sphere Tampering Vulnerability

title: Azure Sphere Tampering Vulnerability


product: Azure Real Time Operating System

summary: Azure RTOS Information Disclosure Vulnerability


summary: Azure RTOS Elevation of Privilege Vulnerability


title: Azure RTOS Elevation of Privilege Vulnerability


product: Microsoft Exchange Server 2013 Cumulative Update 23

product: Microsoft Exchange Server 2016 Cumulative Update 21

product: Microsoft Exchange Server 2016 Cumulative Update 22

product: Microsoft Exchange Server 2019 Cumulative Update 10

product: Microsoft Exchange Server 2019 Cumulative Update 11

summary: Microsoft Exchange Server Spoofing Vulnerability


product: Azure Active Directory

product: Azure Automation

product: Azure Migrate

product: Azure Site Recovery

summary: An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.

title: Microsoft Azure Active Directory security vulnerability


product: Microsoft Edge (Chromium-based)

summary: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability


summary: Microsoft Edge (Chromium-based) Spoofing Vulnerability


product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

product: Microsoft SharePoint Foundation 2013 Service Pack 1

title: Microsoft SharePoint Server Remote Code Execution Vulnerability


product: Microsoft Defender for IoT

summary: Microsoft Defender for IoT Remote Code Execution Vulnerability


title: Microsoft Defender for IoT Remote Code Execution Vulnerability


summary: Microsoft Defender for IoT Elevation of Privilege Vulnerability


product: Microsoft Dynamics 365 (on-premises) version 9.0

product: Microsoft Dynamics 365 (on-premises) version 9.1

summary: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability


product: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

product: Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

product: Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)

product: Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)

summary: Visual Studio Elevation of Privilege Vulnerability


summary: Microsoft SharePoint Server Spoofing Vulnerability


product: Microsoft Exchange Server 2016 Cumulative Update 21

product: Microsoft Exchange Server 2016 Cumulative Update 22

product: Microsoft Exchange Server 2019 Cumulative Update 10

product: Microsoft Exchange Server 2019 Cumulative Update 11

product: Exchange

vulnerability_name: Microsoft Exchange Server Remote Code Execution Vulnerability


product: Visual Studio Code

summary: Visual Studio Code Elevation of Privilege Vulnerability


vendor: dcnglobal

summary: An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. Due to improper parameter validation in the console interface, it is possible for a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access.


product: froxlor

vendor: froxlor

summary: Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.


product: redmine

vendor: redmine

summary: Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.


product: fedora

vendor: fedoraproject

summary: dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.

title: Linux Linux Kernel security vulnerability


product: ShinHer StudyOnline System

vendor: ShinHer Information Co., LTD.

vendor: xinheinformation

summary: The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.


summary: The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.


summary: The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.


summary: The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters.


product: Easytest

vendor: Huachu Digital Technology Co.,Ltd.

vendor: huaju

summary: The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.


summary: The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.


summary: Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.


summary: The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.


vendor: aifu

summary: The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

title: Aifu Cashier Accounting Management System security vulnerability


product: GCB Doctor

summary: 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.

title: 4Mosan Gcb Doctor security vulnerability


product: Apache Tomcat

vendor: Apache Software Foundation

version: Apache Tomcat 9 9.0.40 to 9.0.53

version: Apache Tomcat 8 8.5.60 to 8.5.71

product: tomcat

vendor: apache

product: hci

vendor: netapp

summary: The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

title: Apache Tomcat security vulnerability


product: openrc

summary: checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.

title: Openrc Project Openrc security vulnerability


product: goahead

vendor: embedthis

summary: An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.


ecosystem: python/pypi

product: dask

vendor: anaconda

summary: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.


product: Apache Knox

version: Apache Knox 1.x

less_than: Apache Knox 0.x*

product: knox

summary: When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.


product: Contact Form With Captcha

vendor: Contact Form With Captcha

ecosystem: php/wordpress

summary: The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2.

title: Contact Form With Captcha Project Contact Form With Captcha security vulnerability


product: WP DSGVO Tools (GDPR)

vendor: legalweb

summary: WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

title: Legalweb Wp Dsgvo Tools security vulnerability


product: Starter Templates — Elementor, Gutenberg & Beaver Builder Templates

vendor: BrainStormForce

vendor: brainstormforce

summary: On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.

title: Brainstormforce Starter Templates security vulnerability


product: Contact Form Email

vendor: Contact Form Email

vendor: codepeople

summary: The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

title: Codepeople Contact Form Email security vulnerability


default_status: unaffected

product: WordPress Popular Posts

vendor: WordPress Popular Posts

summary: The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.

title: Wordpress Popular Posts Project Wordpress Popular Posts security vulnerability


product: Preview E-Mails for WooCommerce

vendor: Preview E-Mails for WooCommerce

summary: The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.

title: Preview E-Mails For Woocommerce Project Preview E-Mails For Woocommerce security vulnerability


product: Stetic

vendor: Stetic

product: stetic

vendor: stetic

summary: The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.0.6.

title: Stetic security vulnerability


product: Asgaros Forums

vendor: Asgaros Forums

vendor: asgaros

summary: The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

title: Asgaros Asgaros Forum security vulnerability


product: Variation Swatches for WooCommerce

vendor: Variation Swatches for WooCommerce

summary: The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability.

title: Variation Swatches For Woocommerce Project Variation Swatches For Wooco… security vulnerability


vendor: zucchetti

summary: Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI.


vendor: xorux

summary: A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. (Viewing the passwords requires configuring a web browser to display HTML password input fields.)

title: Xorux Lpar2Rrd security vulnerability


summary: lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.


summary: A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.

title: Xorux Lpar2Rrd security vulnerability


product: busybox

vendor: busybox

product: fedora

vendor: fedoraproject

vendor: netapp

product: solidfire

summary: A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given


summary: An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

title: Busybox security vulnerability


summary: An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.

title: Busybox security vulnerability


summary: A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.

title: Busybox security vulnerability


summary: An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function

title: Busybox security vulnerability


summary: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function

title: Busybox security vulnerability


product: clickhouse

vendor: yandex

vendor: clickhouse

vendor: debian

summary: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.


summary: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.


summary: Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.


summary: Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.


summary: Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.


vendor: oracle

summary: The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.


product: vtk

version: VTK - 9.0.0 and before

vendor: vtk

summary: There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.


product: GNOME anjuta

version: anjuta - 2.0.0

product: anjuta

vendor: gnome

summary: There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrect use of libxml2 API. The vendor forgot to call 'g_free()' to release the return value of 'xmlGetProp()'.


product: colord

summary: There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it.

title: Colord Project Colord security vulnerability


product: Animate

vendor: Adobe

product: animate

vendor: adobe

summary: Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.

title: Adobe Animate security vulnerability


summary: Acrobat Animate versions 21.0.9 (and earlier)is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Animate security vulnerability


product: Premiere Elements

summary: Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

title: Adobe Premiere Elements security vulnerability


product: XMP Toolkit

summary: XMP Toolkit 2021.07 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

title: Adobe Xmp Toolkit Software Development Kit security vulnerability


product: Bridge

product: bridge

summary: Adobe Bridge version 11.1.1 (and earlier) is affected by a double free vulnerability when parsing a crafted DCM file, which could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.

title: Adobe Bridge security vulnerability


product: Tracer SC

vendor: Trane

version: All

vendor: trane

summary: The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.

title: CVE-2021-42534 vulnerability


product: VBASE Pro-RT/ Server-RT (Web Remote)

vendor: VISAM

vendor: visam

summary: VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.

title: Visam Vbase Web-Remote security vulnerability


product: WirelessHART Gateway

vendor: Emerson

vendor: emerson

summary: The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.

title: CVE-2021-42536 vulnerability


summary: VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.


summary: The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.

title: CVE-2021-42538 vulnerability


summary: The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change.

title: CVE-2021-42539 vulnerability


summary: The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.

title: CVE-2021-42540 vulnerability


summary: The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.

title: CVE-2021-42542 vulnerability