Total
1299 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-1435 | 1 Joomla | 1 Joomla\! | 2021-09-20 | 7.5 HIGH | 9.8 CRITICAL |
| Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. | |||||
| CVE-2021-24379 | 1 Wphappycoders | 1 Comments Like Dislike | 2021-09-20 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side | |||||
| CVE-2021-1854 | 1 Apple | 2 Ipados, Iphone Os | 2021-09-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. . | |||||
| CVE-2020-19765 | 1 Proofofdiligencetoken Project | 1 Proofofdiligencetoken | 2021-09-15 | 5.0 MEDIUM | 7.5 HIGH |
| An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack. | |||||
| CVE-2021-28567 | 1 Magento | 1 Magento | 2021-09-14 | 4.0 MEDIUM | 6.5 MEDIUM |
| Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation. | |||||
| CVE-2021-35949 | 1 Owncloud | 1 Owncloud | 2021-09-14 | 5.0 MEDIUM | 5.3 MEDIUM |
| The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share. | |||||
| CVE-2021-34548 | 1 Torproject | 1 Tor | 2021-09-14 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream. | |||||
| CVE-2021-25735 | 1 Kubernetes | 1 Kubernetes | 2021-09-13 | 5.5 MEDIUM | 6.5 MEDIUM |
| A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields. | |||||
| CVE-2016-4514 | 1 Moxa | 2 Pt-7728, Pt-7728 Firmware | 2021-09-13 | 4.6 MEDIUM | 7.7 HIGH |
| Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy. | |||||
| CVE-2021-24006 | 1 Fortinet | 1 Fortimanager | 2021-09-10 | 6.5 MEDIUM | 8.8 HIGH |
| An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL. | |||||
| CVE-2020-9712 | 3 Adobe, Apple, Microsoft | 4 Acrobat Dc, Acrobat Reader Dc, Macos and 1 more | 2021-09-08 | 7.1 HIGH | 5.5 MEDIUM |
| Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass. | |||||
| CVE-2021-36039 | 1 Adobe | 2 Adobe Commerce, Magento Open Source | 2021-09-08 | 4.0 MEDIUM | 6.5 MEDIUM |
| Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information. | |||||
| CVE-2021-22256 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 5.5 MEDIUM | 5.4 MEDIUM |
| Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status | |||||
| CVE-2021-22247 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 4.0 MEDIUM | 4.3 MEDIUM |
| Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics | |||||
| CVE-2021-22243 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 4.0 MEDIUM | 4.3 MEDIUM |
| Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group. | |||||
| CVE-2021-22236 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 6.5 MEDIUM | 8.8 HIGH |
| Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1. | |||||
| CVE-2021-26040 | 1 Joomla | 1 Joomla\! | 2021-08-30 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command. | |||||
| CVE-2021-22253 | 1 Gitlab | 1 Gitlab | 2021-08-30 | 4.9 MEDIUM | 5.4 MEDIUM |
| Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed | |||||
| CVE-2021-22251 | 1 Gitlab | 1 Gitlab | 2021-08-27 | 4.0 MEDIUM | 4.3 MEDIUM |
| Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings | |||||
| CVE-2021-38598 | 1 Openstack | 1 Neutron | 2021-08-27 | 5.8 MEDIUM | 9.1 CRITICAL |
| OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. | |||||