Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Search Type: Search All
There are 151,826 matching records.
Displaying matches 1 through 20.
Vuln ID Summary CVSS Severity
CVE-2021-30044

Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.

Published: April 12, 2021; 8:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-30042

Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php

Published: April 12, 2021; 8:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-30039

Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.

Published: April 12, 2021; 8:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-30034

Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.

Published: April 12, 2021; 8:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-30030

Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.

Published: April 12, 2021; 8:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-29429

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.

Published: April 12, 2021; 6:15:13 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-21393

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.

Published: April 12, 2021; 6:15:13 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-21392

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.

Published: April 12, 2021; 6:15:13 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field.

Published: April 12, 2021; 5:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-22497

Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.

Published: April 12, 2021; 5:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-21394

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.

Published: April 12, 2021; 5:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-21545

Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially exploited to gain arbitrary code execution on the system with privileges of the system user.

Published: April 12, 2021; 4:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-21524

Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Critical as this may lead to system compromise by unauthenticated attackers.

Published: April 12, 2021; 4:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2019-15059

In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords.

Published: April 12, 2021; 4:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-3128

In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.

Published: April 12, 2021; 3:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-3125

In TP-Link TL-XDR3230 < 1.0.12, TL-XDR1850 < 1.0.9, TL-XDR1860 < 1.0.14, TL-XDR3250 < 1.0.2, TL-XDR6060 Turbo < 1.1.8, TL-XDR5430 < 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.

Published: April 12, 2021; 3:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-29357

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.

Published: April 12, 2021; 3:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-29302

TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. The attack vector is: The attacker can get shell of the router by sending a message through the network, which may lead to remote code execution.

Published: April 12, 2021; 3:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2021-23270

In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.

Published: April 12, 2021; 3:15:14 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2020-15390

pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.

Published: April 12, 2021; 3:15:13 PM -0400
V3.x:(not available)
V2.0:(not available)