CVE-2021-39312

Summary: CVE-2021-39312 affects the WordPress True Ranker plugin prior to 2.2.4. The vulnerability is an improper filtering flaw in the local file inclusion path in ~/admin/vendor/datatables/examples/resources/examples.php, allowing an attacker to read arbitrary files (e.g., wp-config.php) via th...

CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2021-39935

CVE-2021-39935 affects GitLab CE/EE, with SSRF via the CI Lint API. Affected versions include GitLab 10.5–14.3.5, 14.4.x before 14.4.4, and 14.5.x before 14.5.2. The issue allows unauthorized external users to perform Server-Side Requests. Multiple connected sources corroborate the vulnerability ...

CVE-2021-24946

The CVE-2021-24946 issue affects the WordPress plugin Modern Events Calendar Lite (before version 6.1.5). The vulnerability is a SQL injection in the mec_load_single_page AJAX action caused by improper sanitisation/escapING of the time parameter, exploitable by unauthenticated users. Descriptions...

CVE-2021-44515

Zoho ManageEngine Desktop Central (and Desktop Central MSP) is affected by CVE-2021-44515, a authentication bypass that enables remote code execution on the server. Affected builds: Enterprise 10.1.2127.17 and earlier require upgrading to 10.1.2127.18; Enterprise 10.1.2128.0–10.1.2137.2 require 1...

CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2021-27860

CVE-2021-27860 affects FatPipe WARP, IPVPN, and MPVPN web management interfaces. An unauthenticated remote attacker can upload arbitrary files to any location on the filesystem on affected devices running versions < 10.1.2r60p92 or

CVE-2021-20039

CVE-2021-20039 is an authenticated command-injection vulnerability in SonicWall SMA100 management interface (/cgi-bin/viewcert) that affects SMA 200/210/400/410/500v appliances. The issue arises from improper neutralization of special elements in a POST request, enabling a remote authenticated at...

CVE-2021-20038

CVE-2021-20038 affects SonicWall SMA100 series appliances (SMA200/210/400/410/500v) with firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier. It is a stack-based buffer overflow in the SMA100 Apache httpd server’s mod_cgi environment variables that allows remote, unauthenticated code...

CVE-2021-44529

CVE-2021-44529 is an Ivanti EPM Cloud Services Appliance (CSA) code injection vulnerability. An unauthenticated user can execute arbitrary code with limited permissions (nobody) via the CSA web stack (notably /client/index.php and related code path). Public documents indicate affected CSA version...

CVE-2021-42567

Summary (concrete details available) Apereo CAS several versions prior to 6.4.1 are vulnerable to a cross‑site scripting (XSS) flaw that can be triggered by POST requests to the REST API endpoints. The core issue is an XSS vulnerability in the REST API handling where user-supplied data is echoed ...

CVE-2021-43798

Grafana CVE-2021-43798 is a directory traversal vulnerability affecting Grafana 8.0.0-beta1 through 8.3.0 (excluding patched versions). The flaw allows access to local files via the vulnerable URL path /public/plugins/ and related API paths described in the advisories. Upstream fixes were release...

CVE-2021-24943

The CVE-2021-24943 entry concerns the WordPress plugin Registrations for the Events Calendar (pre-2.7.6). The issue is an unauthenticated SQL injection in the rtec_send_unregister_link AJAX action, where event_id is not properly sanitised/escaped before usage in a SQL statement. Affected componen...

CVE-2021-24931

The WordPress plugin Secure Copy Content Protection and Content Locking (versions before 2.8.2) is affected by an SQL injection due to unsafely using the sccp_id parameter of the ays_sccp_results_export_file AJAX action. The vulnerability is exploitable by unauthenticated users and can lead to un...

CVE-2021-23758

The ajaxpro.2 NuGet package (Ajax.NET Professional) deserializes arbitrary .NET classes without validation (CWE-502), enabling unauthenticated remote code execution via crafted payloads. Affected versions are before 21.11.29.1 . No workaround exists except updating to the latest version from GitH...

CVE-2021-44427

CVE-2021-44427 is an unauthenticated SQL injection in Rosario Student Information System (rosariosis) before 8.1.1. The vulnerability allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, DELETE) via the /Side.php endpoint using the syear parameter. Affected soft...

CVE-2021-24915

The Contest Gallery WordPress plugin (prior to 13.1.0.6) lacks capability checks and does not sanitise/escape cg-search-user-name-original before using it in a SQL statement when exporting gallery users, enabling unauthenticated SQL injection and disclosure of all usernames and email addresses. T...

CVE-2021-44077

CVE-2021-44077 affects Zoho ManageEngine ServiceDesk Plus prior to 11306, ServiceDesk Plus MSP prior to 10530, and SupportCenter Plus prior to 11014. The issue enables unauthenticated remote code execution via /RestAPI servlet endpoints and ImportTechnicians in Struts configuration. Evidence in t...

CVE-2021-43778

GLPI barcode plugin

CVE-2021-38003

CVE-2021-38003 affects Chromium/Chrome’s V8 engine before version 95.0.4638.69. Description and multiple advisories confirm an inappropriate implementation in V8 that could enable remote code execution via crafted HTML, with exploitation noted in the wild (per Arch Linux ASA notes). Affected comp...