CVE-2021-30118

CVE-2021-30118 affects Kaseya VSA (RMM) prior to 9.5.7, via unauthenticated arbitrary file upload in the web UI path /SystemTab/uploader.aspx. The request can write files with arbitrary content to locations the web server can access (e.g., webroot) and, if code (ASPX) is uploaded, execute it in t...

CVE-2021-25646

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a...