Security Vulnerabilities - CVEs Published In 2021
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637.
CVSS Score
9.8
EPSS Score
0.029
Published
2021-09-01
An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.
CVSS Score
7.8
EPSS Score
0.007
Published
2021-09-01
bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.
CVSS Score
9.1
EPSS Score
0.015
Published
2021-09-01
IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr.
CVSS Score
7.5
EPSS Score
0.011
Published
2021-08-31
A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS).
CVSS Score
7.5
EPSS Score
0.011
Published
2021-08-31
VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.
CVSS Score
9.8
EPSS Score
0.012
Published
2021-08-31
VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account.
CVSS Score
7.5
EPSS Score
0.01
Published
2021-08-31
VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting.
CVSS Score
7.5
EPSS Score
0.01
Published
2021-08-31
Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.
CVSS Score
8.8
EPSS Score
0.011
Published
2021-08-31
The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.
CVSS Score
6.5
EPSS Score
0.01
Published
2021-08-31