Security Vulnerabilities - CVEs Published In 2021
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.
CVSS Score
5.3
EPSS Score
0.014
Published
2021-09-15
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'.
CVSS Score
6.5
EPSS Score
0.019
Published
2021-09-15
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'.
CVSS Score
6.5
EPSS Score
0.016
Published
2021-09-15
PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.
CVSS Score
6.1
EPSS Score
0.011
Published
2021-09-15
vuelidate is vulnerable to Inefficient Regular Expression Complexity
CVSS Score
7.5
EPSS Score
0.012
Published
2021-09-15
vim is vulnerable to Use After Free
CVSS Score
8.2
EPSS Score
0.017
Published
2021-09-15
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
CVSS Score
4.8
EPSS Score
0.011
Published
2021-09-15
prism is vulnerable to Inefficient Regular Expression Complexity
CVSS Score
7.5
EPSS Score
0.01
Published
2021-09-15
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.
CVSS Score
8.8
EPSS Score
0.047
Published
2021-09-15
VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in NVMe functionality. A malicious actor with local non-administrative access to a virtual machine with a virtual NVMe controller present may be able to read privileged information contained in physical memory.
CVSS Score
8.4
EPSS Score
0.003
Published
2021-09-15