Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-45895 | 1 Netgen | 1 Tags Bundle | 2022-01-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface. | |||||
| CVE-2021-35034 | 1 Zyxel | 2 Nbg6604, Nbg6604 Firmware | 2022-01-07 | 6.4 MEDIUM | 9.1 CRITICAL |
| An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted. | |||||
| CVE-2021-43855 | 1 Requarks | 1 Wiki.js | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. The malicious SVG can only be uploaded by crafting a custom request to the server with a fake MIME type. A patch in version 2.5.264 fixes this vulnerability by adding an additional file extension verification check to the optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users. | |||||
| CVE-2021-45232 | 1 Apache | 1 Apisix Dashboard | 2022-01-07 | 7.5 HIGH | 9.8 CRITICAL |
| In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication. | |||||
| CVE-2021-45526 | 1 Netgear | 28 Ex6000, Ex6000 Firmware, Ex6120 and 25 more | 2022-01-07 | 6.5 MEDIUM | 8.8 HIGH |
| Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects EX6000 before 1.0.0.38, EX6120 before 1.0.0.48, EX6130 before 1.0.0.30, R6300v2 before 1.0.4.52, R6400 before 1.0.1.52, R7000 before 1.0.11.126, R7900 before 1.0.4.30, R8000 before 1.0.4.52, R7000P before 1.3.2.124, R8000P before 1.4.1.50, RAX80 before 1.0.3.88, R6900P before 1.3.2.124, R7900P before 1.4.1.50, and RAX75 before 1.0.3.88. | |||||
| CVE-2021-45525 | 1 Netgear | 30 Ex7000, Ex7000 Firmware, R6400 and 27 more | 2022-01-07 | 6.5 MEDIUM | 8.8 HIGH |
| Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects EX7000 before 1.0.1.80, R6400 before 1.0.1.50, R6400v2 before 1.0.4.118, R6700 before 1.0.2.8, R6700v3 before 1.0.4.118, R6900 before 1.0.2.8, R6900P before 1.3.2.124, R7000 before 1.0.9.88, R7000P before 1.3.2.124, R7900 before 1.0.3.18, R7900P before 1.4.1.50, R8000 before 1.0.4.46, R8000P before 1.4.1.50, RAX80 before 1.0.1.56, and WNR3500Lv2 before 1.2.0.62. | |||||
| CVE-2021-40170 | 1 Securitashome | 2 Securitashome Alarm System, Securitashome Alarm System Firmware | 2022-01-06 | 5.8 MEDIUM | 6.8 MEDIUM |
| An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to trigger arbitrary system functionality by replaying previously recorded signals. This lets an adversary, among other things, disarm an armed system. | |||||
| CVE-2021-38961 | 1 Ibm | 6 Power System Ac922 \(8335-gtc\), Power System Ac922 \(8335-gtc\) Firmware, Power System Ac922 \(8335-gtg\) and 3 more | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049. | |||||
| CVE-2021-45099 | 1 Ssh \& Web Terminal Project | 1 Ssh \& Web Terminal | 2022-01-06 | 6.8 MEDIUM | 8.8 HIGH |
| ** DISPUTED ** The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations. | |||||
| CVE-2021-45709 | 1 Crypto2 Project | 1 Crypto2 | 2022-01-06 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur. | |||||
| CVE-2020-36513 | 1 Acc Reader Project | 1 Acc Reader | 2022-01-06 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations. | |||||
| CVE-2020-36512 | 1 Buffoon Project | 1 Buffoon | 2022-01-06 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations. | |||||
| CVE-2021-25993 | 1 Requarks | 1 Wiki.js | 2022-01-06 | 3.5 LOW | 5.4 MEDIUM |
| In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim. | |||||
| CVE-2021-45903 | 1 Salesagility | 1 Suitecrm | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268. | |||||
| CVE-2021-45425 | 1 Safarimontage | 1 Safari Montage | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes. | |||||
| CVE-2021-25990 | 1 If-me | 1 Ifme | 2022-01-06 | 3.5 LOW | 5.4 MEDIUM |
| In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe. | |||||
| CVE-2021-25989 | 1 If-me | 1 Ifme | 2022-01-06 | 3.5 LOW | 5.4 MEDIUM |
| In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them. | |||||
| CVE-2021-25988 | 1 If-me | 1 Ifme | 2022-01-06 | 3.5 LOW | 5.4 MEDIUM |
| In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin. | |||||
| CVE-2021-4176 | 1 Livehelperchat | 1 Live Helper Chat | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-4175 | 1 Livehelperchat | 1 Live Helper Chat | 2022-01-06 | 3.5 LOW | 5.4 MEDIUM |
| livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||