Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-40092 | 1 Squaredup | 1 Squaredup | 2021-12-07 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file. | |||||
| CVE-2021-40091 | 1 Squaredup | 1 Squaredup | 2021-12-07 | 7.5 HIGH | 9.8 CRITICAL |
| An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654. | |||||
| CVE-2021-40333 | 1 Hitachienergy | 4 Fox615, Fox615 Firmware, Xcm20 and 1 more | 2021-12-07 | 5.5 MEDIUM | 7.1 HIGH |
| Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A. | |||||
| CVE-2021-36198 | 1 Johnsoncontrols | 1 Kantech Entrapass | 2021-12-07 | 5.0 MEDIUM | 7.5 HIGH |
| Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. | |||||
| CVE-2021-31632 | 1 B2evolution | 1 B2evolution Cms | 2021-12-07 | 7.5 HIGH | 9.8 CRITICAL |
| b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input. | |||||
| CVE-2021-31631 | 1 B2evolution | 1 B2evolution Cms | 2021-12-07 | 6.8 MEDIUM | 8.8 HIGH |
| b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to escalate privileges. | |||||
| CVE-2021-24866 | 1 Wpdataaccess | 1 Wp Data Access | 2021-12-07 | 7.5 HIGH | 9.8 CRITICAL |
| The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion | |||||
| CVE-2021-44048 | 1 Opendesign | 1 Drawings Explorer | 2021-12-07 | 6.8 MEDIUM | 7.8 HIGH |
| An out-of-bounds write vulnerability exists when reading a TIF file using Open Design Alliance (ODA) Drawings Explorer before 2022.11. The specific issue exists after loading TIF files. Crafted data in a TIF file can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2021-44047 | 1 Opendesign | 1 Drawings Sdk | 2021-12-07 | 6.8 MEDIUM | 7.8 HIGH |
| A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2021-44046 | 1 Opendesign | 1 Prc Sdk | 2021-12-07 | 6.8 MEDIUM | 7.8 HIGH |
| An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function (verifying input data from a U3D file) leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2021-40313 | 1 Piwigo | 1 Piwigo | 2021-12-07 | 6.5 MEDIUM | 8.8 HIGH |
| Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. | |||||
| CVE-2021-44045 | 1 Opendesign | 1 Drawings Sdk | 2021-12-07 | 6.8 MEDIUM | 7.8 HIGH |
| An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation for the XFAT sectors count can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2021-44044 | 1 Opendesign | 1 Drawings Sdk | 2021-12-07 | 6.8 MEDIUM | 7.8 HIGH |
| An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing JPG files. Crafted data in a JPG (4 extraneous bytes before the marker 0xca) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. | |||||
| CVE-2021-36567 | 1 Thinkphp | 1 Thinkphp | 2021-12-07 | 10.0 HIGH | 9.8 CRITICAL |
| ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache. | |||||
| CVE-2021-36564 | 1 Thinkphp | 1 Thinkphp | 2021-12-07 | 7.5 HIGH | 9.8 CRITICAL |
| ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php. | |||||
| CVE-2021-43931 | 1 Webhmi | 2 Webhmi, Webhmi Firmware | 2021-12-06 | 7.5 HIGH | 9.8 CRITICAL |
| The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. | |||||
| CVE-2021-35242 | 1 Solarwinds | 1 Serv-u | 2021-12-06 | 6.8 MEDIUM | 8.8 HIGH |
| Serv-U server responds with valid CSRFToken when the request contains only Session. | |||||
| CVE-2021-25041 | 1 10web | 1 Photo Gallery | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action | |||||
| CVE-2021-23562 | 1 Tiny | 1 Plupload | 2021-12-06 | 6.8 MEDIUM | 8.8 HIGH |
| This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file. | |||||
| CVE-2021-35344 | 1 Tsmuxer Project | 1 Tsmuxer | 2021-12-06 | 7.5 HIGH | 9.8 CRITICAL |
| tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h. | |||||