CVE-2021-20687

Cross-site request forgery CSRF vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20686

CVE-2021-20686 is a stored cross-site scripting vulnerability in Kagemai 0.8.8 that allows an arbitrary script to run in a user’s browser. The public documents identify the vulnerable product and version (Kagemai 0.8.8) and describe the impact as arbitrary script execution via unspecified vectors...

CVE-2021-20686

Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20685

CVE-2021-20685 concerns the Kagemai bug-tracking system. Multiple sources identify it as a cross-site scripting (XSS) vulnerability in Kagemai versions around 0.8.6–0.8.8, permitting remote attackers to inject arbitrary scripts that run in a user’s web browser. The precise attack vectors are not ...

CVE-2021-20684

Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20684

CVE-2021-20684 is a stored cross-site scripting vulnerability in MagazinegerZ v1.01 (CGI Script Market). The affected component is MagazinegerZ’s web interface used for email newsletter distribution, with the root cause described as an arbitrary script execution in the admin browser when logging ...

CVE-2021-20685

Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20682

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors...

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. Even with the maximu...

Updated discover package fixes a security vulnerability

Discover fetches the description and related texts of some applications/plugins from store.kde.org. That text is displayed to the user, after turning into a clickable link any part of the text that looks like a link. This is done for any kind of link, be it smb:// nfs:// etc. when in fact it only...

CVE-2021-20675

M-System DL8 series type A DL8-A versions prior to Ver3.0, type B DL8-B versions prior to Ver3.0, type C DL8-C versions prior to Ver3.0, type D DL8-D versions prior to Ver3.0, and type E DL8-E versions prior to Ver3.0 allows remote authenticated attackers to cause a denial of service DoS conditio...

CVE-2021-20676

M-System DL8 series type A DL8-A versions prior to Ver3.0, type B DL8-B versions prior to Ver3.0, type C DL8-C versions prior to Ver3.0, type D DL8-D versions prior to Ver3.0, and type E DL8-E versions prior to Ver3.0 allows remote authenticated attackers to bypass access restriction and conduct...

CVE-2021-20630

Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone Messages via unspecified vectors...

Input validation

Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspecified vectors...

Improper access control

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20676

M-System DL8 series type A DL8-A versions prior to Ver3.0, type B DL8-B versions prior to Ver3.0, type C DL8-C versions prior to Ver3.0, type D DL8-D versions prior to Ver3.0, and type E DL8-E versions prior to Ver3.0 allows remote authenticated attackers to bypass access restriction and conduct...

CVE-2021-20633

Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors...

CVE-2021-20627

Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20624

Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Scheduler via unspecified vectors...