CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages.
Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests.
Cyberoamos, Cyberoam, Anti-virus7.6.3, Anti-virus_for_sophos_central, Anti-virus_for_sophos_home, Astaro_security_gateway, Astaro_security_gateway_firmware, Cloud_optix, Cyberoam_cr100ing_utm, Cyberoam_cr100ing_utm_firmware
2021-07-21
N/A
8.8 HIGH
Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation.
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Centreon before 19.10.7 exposes Session IDs in server responses.
HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5.
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.