Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-3453 | 1 Lenovo | 42 730s-13iml, 730s-13iml Firmware, Ideacentre Aio 5-24imb05 and 39 more | 2021-07-30 | 2.1 LOW | 4.6 MEDIUM |
| Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage. | |||||
| CVE-2020-23706 | 1 Ok-file-formats Project | 1 Ok-file-formats | 2021-07-30 | 4.3 MEDIUM | 6.5 MEDIUM |
| A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file. | |||||
| CVE-2020-5320 | 1 Dell | 2 Emc Openmanage Enterprise, Emc Openmanage Enterprise-modular | 2021-07-29 | 6.5 MEDIUM | 7.2 HIGH |
| Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions. | |||||
| CVE-2020-5321 | 1 Dell | 2 Emc Openmanage Enterprise, Emc Openmanage Enterprise-modular | 2021-07-29 | 5.5 MEDIUM | 7.6 HIGH |
| Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input validation vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to spawn tasks with elevated privileges. | |||||
| CVE-2020-18155 | 1 Intelliants | 1 Subrion | 2021-07-29 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. | |||||
| CVE-2021-26799 | 1 Omeka | 1 Omeka | 2021-07-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML. | |||||
| CVE-2021-25201 | 1 Learning Management System Project | 1 Learning Management System | 2021-07-29 | 5.0 MEDIUM | 7.5 HIGH |
| SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information. | |||||
| CVE-2021-36230 | 1 Hashicorp | 1 Terraform | 2021-07-29 | 6.5 MEDIUM | 8.8 HIGH |
| HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1. | |||||
| CVE-2021-24022 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2021-07-29 | 2.1 LOW | 4.4 MEDIUM |
| A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value. | |||||
| CVE-2021-25203 | 1 Victor Cms Project | 1 Victor Cms | 2021-07-29 | 7.5 HIGH | 9.8 CRITICAL |
| Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php. | |||||
| CVE-2020-7866 | 1 Tobesoft | 1 Xplatform | 2021-07-29 | 7.5 HIGH | 9.8 CRITICAL |
| When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation | |||||
| CVE-2019-25050 | 1 Osgeo | 1 Gdal | 2021-07-29 | 4.6 MEDIUM | 7.8 HIGH |
| netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset). | |||||
| CVE-2021-33501 | 1 Overwolf | 1 Overwolf | 2021-07-29 | 9.3 HIGH | 9.6 CRITICAL |
| Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL. | |||||
| CVE-2021-23409 | 1 Go-proxyproto Project | 1 Go-proxyproto | 2021-07-29 | 5.0 MEDIUM | 7.5 HIGH |
| The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. | |||||
| CVE-2020-4821 | 1 Ibm | 2 Infosphere Change Data Capture, Infosphere Data Replication | 2021-07-29 | 6.8 MEDIUM | 9.8 CRITICAL |
| IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configurations, could allow a user to bypass authentication mechanisms using an empty password string. IBM X-Force ID: 189834 | |||||
| CVE-2021-25701 | 1 Teradici | 1 Pcoip Client | 2021-07-29 | 2.1 LOW | 5.5 MEDIUM |
| The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety of IOCTLs, which allowed an attacker to cause a denial of service. | |||||
| CVE-2021-37155 | 1 Wolfssl | 1 Wolfssl | 2021-07-29 | 7.5 HIGH | 9.8 CRITICAL |
| wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response. | |||||
| CVE-2021-36978 | 1 Qpdf Project | 1 Qpdf | 2021-07-29 | 4.3 MEDIUM | 5.5 MEDIUM |
| QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails. | |||||
| CVE-2021-21407 | 1 Combodo | 1 Itop | 2021-07-29 | 4.3 MEDIUM | 6.5 MEDIUM |
| Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0. | |||||
| CVE-2021-32667 | 1 Typo3 | 1 Typo3 | 2021-07-29 | 3.5 LOW | 5.4 MEDIUM |
| TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue. | |||||