CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.
1288h_v5, 1288h_v5_firmware, 2288h_v5, 2288h_v5_firmware, 2488_v5, 2488_v5_firmware, 5300hi, 5300hi_firmware, 5310ei, 5310ei_firmware
2021-07-21
N/A
7.5 HIGH
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a memory leak vulnerability. The software does not sufficiently track and release allocated memory while parse certain message, the attacker sends the message continuously that could consume remaining memory. Successful exploit could cause memory exhaust.
Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.
SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.
1288h_v5, 1288h_v5_firmware, 2288h_v5, 2288h_v5_firmware, 2488_v5, 2488_v5_firmware, 5300hi, 5300hi_firmware, 5310ei, 5310ei_firmware
2021-07-21
N/A
5.3 MEDIUM
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in the affected products in some special scenarios to exploit the vulnerability. Due to improper race conditions of different operations, successful exploit will lead to Dangling pointer dereference, causing some service abnormal.
1288h_v5, 1288h_v5_firmware, 2288h_v5, 2288h_v5_firmware, 2488_v5, 2488_v5_firmware, 5300hi, 5300hi_firmware, 5310ei, 5310ei_firmware
2021-07-21
N/A
6.8 MEDIUM
HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper authentication of specific interface, in specific scenario attackers could access specific interface without authentication. Successful exploit could allow the attacker to perform unauthorized operations.
A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.
An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.