Latest CVE Feed
-
5.9
MEDIUMCVE-2021-40529
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver'... Read more
- Published: Sep. 06, 2021
- Modified: Nov. 21, 2024
-
8.6
HIGHCVE-2021-40527
Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in ... Read more
Affected Products : peloton- Published: Oct. 25, 2021
- Modified: Nov. 21, 2024
-
5.3
MEDIUMCVE-2021-40526
Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling th... Read more
- Published: Oct. 25, 2021
- Modified: Nov. 21, 2024
-
9.1
CRITICALCVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgra... Read more
Affected Products : james- Published: Jan. 04, 2022
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2021-40524
In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not ant... Read more
Affected Products : pure-ftpd- Published: Sep. 05, 2021
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2021-40523
In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which le... Read more
Affected Products : contiki- Published: Sep. 05, 2021
- Modified: Nov. 21, 2024
-
10.0
HIGHCVE-2021-40521
Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.... Read more
- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
9.8
CRITICALCVE-2021-40520
Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.... Read more
- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
10.0
CRITICALCVE-2021-40519
Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.... Read more
- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
6.5
MEDIUMCVE-2021-40518
Airangel HSMX Gateway devices through 5.2.04 allow CSRF.... Read more
- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
5.4
MEDIUMCVE-2021-40517
Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access.... Read more
- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2021-40516
WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.... Read more
- Published: Sep. 05, 2021
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2021-40511
OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.... Read more
Affected Products : mastro- Published: Jun. 21, 2022
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2021-40510
XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.... Read more
Affected Products : mastro- Published: Jun. 21, 2022
- Modified: Nov. 21, 2024
-
5.4
MEDIUMCVE-2021-40509
ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.... Read more
Affected Products : jforum- Published: Sep. 04, 2021
- Modified: Nov. 21, 2024
-
4.9
MEDIUMCVE-2021-40504
A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.... Read more
Affected Products : netweaver_application_server_abap- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
7.8
HIGHCVE-2021-40503
An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensit... Read more
Affected Products : gui_for_windows- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
8.8
HIGHCVE-2021-40502
SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they d... Read more
Affected Products : commerce- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
8.1
HIGHCVE-2021-40501
SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the... Read more
Affected Products : abap_platform_kernel- Published: Nov. 10, 2021
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2021-40500
SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and ... Read more
Affected Products : businessobjects_business_intelligence_platform- Published: Oct. 12, 2021
- Modified: Nov. 21, 2024