6046 matches found
CVE-2021-25877
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php...
CVE-2021-25877
AVideo/YouPHPTube 10.0 and earlier is affected by an insecure file write vulnerability. An administrator-privileged user can write arbitrary files on the filesystem via the save.php file using lag and code variables. Documented impact is ability to write files on the server filesystem, enabli...
CVE-2021-25877
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php...
Sonicwall SonicOS 6.5.4 Cross Site Scripting
Document Title: =============== Sonicwall SonicOS 6.5.4 - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2272 Release Date: ============= 2021-10-18 Vulnerability Laboratory ID VL-ID:...
PHP Melody 3.0 Cross Site Scripting
Document Title: =============== PHP Melody v3.0 - Editor Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2291 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date: ===========...
CVE-2021-25977
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution...
CVE-2021-25977 Piranha CMS - Stored XSS in Page Title
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution...
Code injection
The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality...
CVE-2021-42540 Emerson WirelessHART Gateway
The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality...
CVE-2021-42540
The CVE-2021-42540 entry relates to Emerson WirelessHART Gateway and describes an unsanitized extract folder vulnerability in system configuration. The underlying issue allows a low-privileged user to overwrite settings and other key functionality due to missing input/permission validation during...
PHP Melody v3.0 - (Editor) Persistent XSS Vulnerability
Document Title: =============== PHP Melody v3.0 - Editor Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2291 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date: ===========...
CVE-2021-38911
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940...
Code injection
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940...
CVE-2021-38911
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940...
SUSE SLES12: kernel-livepatch-4_12_14-197_86-default / etc (SUSE-SU-2021:3443-1)
The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3443-1 advisory. This update for the Linux Kernel 4.12.14-12263 fixes several issues. The following security issues were fixed: - CVE-2021-38160: Fixed...
mysql: Server: DML unspecified vulnerability (CPU Jan 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server...
CVE-2021-38923
IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. IBM X-Force ID: 210162...
Code injection
IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. IBM X-Force ID: 210162...
CVE-2021-38923
CVE-2021-38923 affects IBM PowerVM Hypervisor FW1010. The vulnerability arises from assigning duplicate WWPNs to virtual fiber channel adapters in peer VMs, which could allow a privileged user to gain access to another VM. Affected product: PowerVM Hypervisor FW1010 (Power 10 lineage). The IBM Se...