Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-16782 | 3 Fedoraproject, Opensuse, Rack Project | 3 Fedora, Leap, Rack | 2021-11-02 | 4.3 MEDIUM | 5.9 MEDIUM |
| There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison. | |||||
| CVE-2019-15577 | 1 Gitlab | 1 Gitlab | 2021-11-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing. | |||||
| CVE-2019-15582 | 1 Gitlab | 1 Gitlab | 2021-11-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment. | |||||
| CVE-2019-15579 | 1 Gitlab | 1 Gitlab | 2021-11-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones. | |||||
| CVE-2021-24813 | 1 E-dynamics | 1 Events Made Easy | 2021-11-02 | 3.5 LOW | 4.8 MEDIUM |
| The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24799 | 1 Tipsandtricks-hq | 1 Far Future Expiry Header | 2021-11-02 | 4.3 MEDIUM | 4.3 MEDIUM |
| The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. | |||||
| CVE-2021-24794 | 1 Connections-pro | 1 Connections Business Directory | 2021-11-02 | 3.5 LOW | 4.8 MEDIUM |
| The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-24793 | 1 Etruel | 1 Wpematico Rss Feed Fetcher | 2021-11-02 | 3.5 LOW | 4.8 MEDIUM |
| The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-24789 | 1 Flat Preloader Project | 1 Flat Preloader | 2021-11-02 | 3.5 LOW | 4.8 MEDIUM |
| The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed | |||||
| CVE-2021-24781 | 1 Imagesourcecontrol | 1 Image Source Control | 2021-11-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit) | |||||
| CVE-2021-24773 | 1 Wpdownloadmanager | 1 Wordpress Download Manager | 2021-11-02 | 3.5 LOW | 4.8 MEDIUM |
| The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2020-14330 | 2 Debian, Redhat | 2 Debian Linux, Ansible Engine | 2021-11-02 | 2.1 LOW | 5.5 MEDIUM |
| An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality. | |||||
| CVE-2020-10754 | 2 Fedoraproject, Gnome | 2 Fedora, Networkmanager | 2021-11-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely. | |||||
| CVE-2021-24723 | 1 Wpreactions | 1 Wp Reactions Lite | 2021-11-02 | 3.5 LOW | 5.4 MEDIUM |
| The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages. | |||||
| CVE-2021-24716 | 1 Webnus | 1 Modern Events Calendar Lite | 2021-11-02 | 3.5 LOW | 5.4 MEDIUM |
| The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin. | |||||
| CVE-2021-24715 | 1 Wp Sitemap Page Project | 1 Wp Sitemap Page | 2021-11-02 | 3.5 LOW | 4.8 MEDIUM |
| The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-30817 | 1 Apple | 1 Macos | 2021-11-02 | 4.3 MEDIUM | 5.5 MEDIUM |
| A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.5. A malicious application may be able to access data about the accounts the user is using Family Sharing with. | |||||
| CVE-2021-36551 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2021-11-02 | 3.5 LOW | 5.4 MEDIUM |
| TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module. | |||||
| CVE-2020-29629 | 1 Apple | 1 Macos | 2021-11-02 | 4.3 MEDIUM | 5.5 MEDIUM |
| An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to read restricted memory. | |||||
| CVE-2020-10005 | 1 Apple | 1 Macos | 2021-11-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. An attacker in a privileged network position may be able to perform denial of service. | |||||
| CVE-2021-1821 | 1 Apple | 2 Macos, Watchos | 2021-11-02 | 7.1 HIGH | 6.5 MEDIUM |
| A logic issue was addressed with improved state management. This issue is fixed in watchOS 7.6, macOS Big Sur 11.5. Visiting a maliciously crafted webpage may lead to a system denial of service. | |||||
| CVE-2021-30892 | 1 Apple | 2 Mac Os X, Macos | 2021-11-02 | 4.3 MEDIUM | 5.5 MEDIUM |
| An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to modify protected parts of the file system. | |||||
| CVE-2021-30896 | 1 Apple | 5 Ipad Os, Iphone Os, Macos and 2 more | 2021-11-02 | 4.3 MEDIUM | 5.5 MEDIUM |
| A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, tvOS 15.1, watchOS 8.1, macOS Monterey 12.0.1. A malicious application may be able to read user's gameplay data. | |||||
| CVE-2019-15116 | 1 Sandhillsdev | 1 Easy Digital Downloads | 2021-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. | |||||
| CVE-2018-20199 | 2 Audiocoding, Debian | 2 Freeware Advanced Audio Decoder 2, Debian Linux | 2021-11-02 | 4.3 MEDIUM | 5.5 MEDIUM |
| A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case. | |||||
| CVE-2021-22456 | 1 Huawei | 1 Harmonyos | 2021-11-02 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel System unavailable. | |||||
| CVE-2017-9216 | 2 Artifex, Debian | 2 Jbig2dec, Debian Linux | 2021-11-02 | 4.3 MEDIUM | 6.5 MEDIUM |
| libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file. | |||||
| CVE-2021-24682 | 1 Wpkube | 1 Cool Tag Cloud | 2021-11-02 | 3.5 LOW | 5.4 MEDIUM |
| The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2021-30911 | 1 Apple | 4 Ipad Os, Iphone Os, Mac Os X and 1 more | 2021-11-02 | 4.3 MEDIUM | 5.5 MEDIUM |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, iOS 15.1 and iPadOS 15.1, macOS Big Sur 11.6.1. Processing a maliciously crafted USD file may disclose memory contents. | |||||
| CVE-2021-36550 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2021-11-02 | 3.5 LOW | 5.4 MEDIUM |
| TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module. | |||||
| CVE-2021-22459 | 1 Huawei | 1 Harmonyos | 2021-11-02 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause System functions which are unavailable. | |||||
| CVE-2021-22460 | 1 Huawei | 1 Harmonyos | 2021-11-02 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to bypass the control mechanism. | |||||
| CVE-2021-22455 | 1 Huawei | 1 Harmonyos | 2021-11-02 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause the memory which is not released. | |||||
| CVE-2021-29868 | 1 Ibm | 1 I2 Ibase | 2021-11-02 | 2.1 LOW | 5.5 MEDIUM |
| IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213. | |||||
| CVE-2021-22482 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is an Uninitialized variable vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of invalid data. | |||||
| CVE-2021-22475 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is an Improper permission management vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2021-22490 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is a Permission verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect the device performance. | |||||
| CVE-2021-36987 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-01 | 7.1 HIGH | 5.9 MEDIUM |
| There is a issue that nodes in the linked list being freed for multiple times in Huawei Smartphone due to race conditions. Successful exploitation of this vulnerability can cause the system to restart. | |||||
| CVE-2021-36997 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is a Low memory error in Huawei Smartphone due to the unlimited size of images to be parsed.Successful exploitation of this vulnerability may cause the Gallery or Files app to exit unexpectedly. | |||||
| CVE-2021-36996 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of certain virtual information. | |||||
| CVE-2021-30912 | 1 Apple | 2 Mac Os X, Macos | 2021-11-01 | 4.3 MEDIUM | 5.5 MEDIUM |
| The issue was addressed with improved permissions logic. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may gain access to a user's Keychain items. | |||||
| CVE-2021-36998 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to read an array that is out of bounds. | |||||
| CVE-2021-29786 | 1 Ibm | 6 Engineering Lifecycle Optimization, Engineering Workflow Management, Rational Collaborative Lifecycle Management and 3 more | 2021-11-01 | 4.0 MEDIUM | 6.5 MEDIUM |
| IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172. | |||||
| CVE-2021-22461 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Allocation of Resources Without Limits or Throttling vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash. | |||||
| CVE-2021-22407 | 1 Huawei | 2 Emui, Magic Ui | 2021-11-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2021-22462 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause kernel crash. | |||||
| CVE-2021-22467 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to read at any address. | |||||
| CVE-2021-22463 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Use After Free vulnerability . Local attackers may exploit this vulnerability to cause Kernel Information disclosure. | |||||
| CVE-2021-22471 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash. | |||||
| CVE-2021-22466 | 1 Huawei | 1 Harmonyos | 2021-11-01 | 2.1 LOW | 5.5 MEDIUM |
| A component of the HarmonyOS has a Use After Free vulnerability. Local attackers may exploit this vulnerability to cause kernel crash. | |||||