Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-23419 | 1 Open-graph Project | 1 Open-graph | 2021-08-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload. | |||||
| CVE-2021-38197 | 1 Go-unarr Project | 1 Go-unarr | 2021-08-16 | 10.0 HIGH | 9.8 CRITICAL |
| unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive. | |||||
| CVE-2020-18457 | 1 Bycms Project | 1 Bycms | 2021-08-16 | 6.0 MEDIUM | 6.8 MEDIUM |
| Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html. | |||||
| CVE-2020-20981 | 1 Metinfo | 1 Metinfo | 2021-08-16 | 5.0 MEDIUM | 7.5 HIGH |
| A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information. | |||||
| CVE-2020-36457 | 1 Lever Project | 1 Level | 2021-08-16 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T. | |||||
| CVE-2020-18454 | 1 Bycms Project | 1 Bycms | 2021-08-16 | 6.0 MEDIUM | 6.8 MEDIUM |
| Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module_id/70/group_id/1.html. | |||||
| CVE-2021-38189 | 1 Lettre | 1 Lettre | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands. | |||||
| CVE-2021-29714 | 1 Ibm | 1 Content Navigator | 2021-08-16 | 4.0 MEDIUM | 6.5 MEDIUM |
| IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968. | |||||
| CVE-2021-24520 | 1 Coderstimes | 1 Out Of Stock Message For Woocommerce | 2021-08-16 | 6.5 MEDIUM | 8.8 HIGH |
| The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability. | |||||
| CVE-2021-31655 | 1 Trendnet | 2 Tv-ip110wn, Tv-ip110wn Firmware | 2021-08-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. in a GET request in view.cgi. | |||||
| CVE-2020-36456 | 1 Toolshed Project | 1 Toolshed | 2021-08-16 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the toolshed crate through 2020-11-15 for Rust. In CopyCell<T>, the Send trait lacks bounds on the contained type. | |||||
| CVE-2020-36455 | 1 Brokenlamp | 1 Slock | 2021-08-16 | 5.1 MEDIUM | 8.1 HIGH |
| An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync. | |||||
| CVE-2020-20979 | 1 8cms | 1 Ljcms | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code. | |||||
| CVE-2020-36454 | 1 Parc Project | 1 Parc | 2021-08-16 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak<T> has an unconditional implementation of Send without trait bounds on T. | |||||
| CVE-2021-37152 | 1 Sonatype | 1 Nexus Repository Manager | 2021-08-16 | 3.5 LOW | 5.4 MEDIUM |
| Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications. | |||||
| CVE-2021-38187 | 1 Anymap Project | 1 Anymap | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64. | |||||
| CVE-2020-18456 | 1 Pbootcms | 1 Pbootcms | 2021-08-16 | 3.5 LOW | 4.8 MEDIUM |
| Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php. | |||||
| CVE-2021-38565 | 1 Foxitsoftware | 2 Pdf Editor, Pdf Reader | 2021-08-16 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm. | |||||
| CVE-2014-5084 | 1 Sphiderpro | 1 Sphider Pro | 2021-08-16 | 6.5 MEDIUM | 8.8 HIGH |
| A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitrary code. CVE-2014-5084 pertains to instances of fwrite in Sphider Pro only, but do not exist in either Sphider or Sphider Plus. | |||||
| CVE-2014-5081 | 3 Sphider, Sphider-plus, Sphiderpro | 3 Sphider, Sphider-plus, Sphider Pro | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass | |||||
| CVE-2014-5087 | 3 Sphider, Sphider-plus, Sphiderpro | 3 Sphider, Sphider-plus, Sphider Pro | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-36472 | 1 Max7301 Project | 1 Max7301 | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain. | |||||
| CVE-2021-38564 | 1 Foxitsoftware | 2 Pdf Editor, Pdf Reader | 2021-08-16 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand. | |||||
| CVE-2020-36471 | 1 Generator Project | 1 Generator | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds. | |||||
| CVE-2020-36470 | 1 Disrustor Project | 1 Disrustor | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references. | |||||
| CVE-2020-36469 | 1 Appendix Project | 1 Appendix | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the appendix crate through 2020-11-15 for Rust. For the generic K and V type parameters, Send and Sync are implemented unconditionally. | |||||
| CVE-2020-36468 | 1 Cgc Project | 1 Cgc | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer. | |||||
| CVE-2020-36461 | 1 Noise Search Project | 1 Noise Search | 2021-08-16 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the noise_search crate through 2020-12-10 for Rust. There are unconditional implementations of Send and Sync for MvccRwLock. | |||||
| CVE-2020-36453 | 1 Scottqueue Project | 1 Scottqueue | 2021-08-16 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the scottqueue crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for Queue<T>. | |||||
| CVE-2020-21363 | 1 Maccms | 1 Maccms | 2021-08-16 | 5.5 MEDIUM | 6.5 MEDIUM |
| An arbitrary file deletion vulnerability exists within Maccms10. | |||||
| CVE-2021-32438 | 1 Gpac | 1 Gpac | 2021-08-16 | 4.3 MEDIUM | 5.5 MEDIUM |
| The gf_media_export_filters function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. | |||||
| CVE-2020-21359 | 1 Maccms | 1 Maccms | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name. | |||||
| CVE-2021-32440 | 1 Gpac | 1 Gpac | 2021-08-16 | 4.3 MEDIUM | 5.5 MEDIUM |
| The Media_RewriteODFrame function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. | |||||
| CVE-2021-32439 | 1 Gpac | 1 Gpac | 2021-08-16 | 6.8 MEDIUM | 7.8 HIGH |
| Buffer overflow in the stbl_AppendSize function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file. | |||||
| CVE-2021-32437 | 1 Gpac | 1 Gpac | 2021-08-16 | 4.3 MEDIUM | 5.5 MEDIUM |
| The gf_hinter_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command. | |||||
| CVE-2020-36451 | 1 Rcu Cell Project | 1 Rcu Cell | 2021-08-16 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust. There are unconditional implementations of Send and Sync for RcuCell<T>. | |||||
| CVE-2017-16631 | 1 Sapphireims | 1 Sapphireims | 2021-08-16 | 4.0 MEDIUM | 6.5 MEDIUM |
| In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Reference (IDOR) in the "Account Password Reset" functionality. | |||||
| CVE-2017-16630 | 1 Sapphireims | 1 Sapphireims | 2021-08-16 | 6.5 MEDIUM | 8.8 HIGH |
| In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object Reference (IDOR) in the local user creation function. | |||||
| CVE-2017-16632 | 1 Sapphireims | 1 Sapphireims | 2021-08-16 | 5.0 MEDIUM | 7.5 HIGH |
| In SapphireIMS 4097_1, the password in the database is stored in Base64 format. | |||||
| CVE-2021-38191 | 1 Tokio Project | 1 Tokio | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. | |||||
| CVE-2021-38194 | 1 Arcworks | 1 Ark-r1cs-std | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified. | |||||
| CVE-2021-38190 | 1 Dimforge | 1 Nalgebra | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count. | |||||
| CVE-2021-22919 | 1 Citrix | 21 4000-wo, 4100-wo, 5000-wo and 18 more | 2021-08-16 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed. | |||||
| CVE-2021-38195 | 1 Parity | 1 Libsecp256k1 | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow. | |||||
| CVE-2021-38196 | 1 Better-macro Project | 1 Better-macro | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose. | |||||
| CVE-2020-36467 | 1 Cgc Project | 1 Cgc | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::get returns more than one mutable reference to the same object. | |||||
| CVE-2020-36466 | 1 Cgc Project | 1 Cgc | 2021-08-16 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr implements Send and Sync for all types. | |||||
| CVE-2020-25561 | 1 Sapphireims | 1 Sapphireims | 2021-08-16 | 4.6 MEDIUM | 7.8 HIGH |
| SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client. | |||||
| CVE-2020-25560 | 1 Sapphireims | 1 Sapphireims | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on “ping”, “traceroute” and “snmp” functions and execute code on the server. We also observed the same is true if the JSESSIONID is completely removed. | |||||
| CVE-2020-25563 | 1 Sapphireims | 1 Sapphireims | 2021-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemoteMgmtTaskSave (Automation Tasks) feature and not having a JSESSIONID. | |||||