Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-40238 | 1 Webuzo | 1 Webuzo | 2021-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo. | |||||
| CVE-2020-21322 | 1 Feehi | 1 Feehicms | 2021-09-28 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2021-40881 | 1 Publiccms | 1 Publiccms | 2021-09-28 | 7.5 HIGH | 9.8 CRITICAL |
| An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code. | |||||
| CVE-2020-21321 | 1 Emlog | 1 Emlog | 2021-09-28 | 4.3 MEDIUM | 4.3 MEDIUM |
| emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articles. | |||||
| CVE-2021-37913 | 1 Hgiga | 1 Oaklouds Portal | 2021-09-28 | 10.0 HIGH | 9.8 CRITICAL |
| The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in. | |||||
| CVE-2021-1976 | 1 Qualcomm | 494 Apq8009, Apq8009 Firmware, Apq8009w and 491 more | 2021-09-28 | 10.0 HIGH | 9.8 CRITICAL |
| A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | |||||
| CVE-2021-33691 | 1 Sap | 1 Netweaver Development Infrastructure | 2021-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.SAP NetWeaver Development Infrastructure Notification Service allows a threat actor to send crafted scripts to a victim. If the victim has an active session when the crafted script gets executed, the threat actor could compromise information in victims session, and gain access to some sensitive information also. | |||||
| CVE-2021-33690 | 1 Sap | 1 Netweaver Development Infrastructure | 2021-09-28 | 6.5 MEDIUM | 9.9 CRITICAL |
| Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet. | |||||
| CVE-2021-3811 | 1 Pi-hole | 1 Web Interface | 2021-09-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-36582 | 1 Kooboo | 1 Kooboo Cms | 2021-09-28 | 10.0 HIGH | 9.8 CRITICAL |
| In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell from the victim server. The files are uploaded to /Content/Template/root/reverse-shell.aspx and can be simply triggered by browsing that URL. | |||||
| CVE-2021-33704 | 1 Sap | 1 Business One | 2021-09-28 | 6.5 MEDIUM | 8.8 HIGH |
| The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users. | |||||
| CVE-2021-33692 | 1 Sap | 1 Cloud Connector | 2021-09-28 | 5.0 MEDIUM | 7.5 HIGH |
| SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories. | |||||
| CVE-2021-33694 | 1 Sap | 1 Cloud Connector | 2021-09-28 | 3.5 LOW | 4.8 MEDIUM |
| SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting. | |||||
| CVE-2021-33695 | 1 Sap | 1 Cloud Connector | 2021-09-28 | 6.4 MEDIUM | 9.1 CRITICAL |
| Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate. | |||||
| CVE-2021-37909 | 1 Tssservisignadapter Project | 1 Tssservisignadapter | 2021-09-28 | 7.5 HIGH | 9.8 CRITICAL |
| WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code. | |||||
| CVE-2021-39214 | 1 Mitmproxy | 1 Mitmproxy | 2021-09-28 | 7.5 HIGH | 9.8 CRITICAL |
| mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless one uses mitmproxy to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 7.0.3 and above. | |||||
| CVE-2021-33696 | 1 Sap | 1 Businessobjects Business Intelligence | 2021-09-28 | 3.5 LOW | 5.4 MEDIUM |
| SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading to non-permanently deface or modify displayed content from a Web site. | |||||
| CVE-2021-33698 | 1 Sap | 1 Business One | 2021-09-28 | 6.5 MEDIUM | 8.8 HIGH |
| SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format validation. | |||||
| CVE-2021-33700 | 1 Sap | 1 Business One | 2021-09-28 | 4.6 MEDIUM | 7.8 HIGH |
| SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application. | |||||
| CVE-2021-1947 | 1 Qualcomm | 174 Apq8009w, Apq8009w Firmware, Apq8053 and 171 more | 2021-09-28 | 7.2 HIGH | 7.8 HIGH |
| Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | |||||