Security Vulnerabilities - CVEs Published In 2021
A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xp_cmdshell.
CVSS Score
9.8
EPSS Score
0.027
Published
2021-08-24
A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php.
CVSS Score
9.8
EPSS Score
0.019
Published
2021-08-24
In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL.
CVSS Score
7.5
EPSS Score
0.017
Published
2021-08-24
The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution.
CVSS Score
9.8
EPSS Score
0.045
Published
2021-08-24
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0
CVSS Score
9.8
EPSS Score
0.04
Published
2021-08-24
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
CVSS Score
5.4
EPSS Score
0.009
Published
2021-08-24
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
CVSS Score
7.5
EPSS Score
0.018
Published
2021-08-24
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
CVSS Score
5.4
EPSS Score
0.004
Published
2021-08-24
All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
CVSS Score
6.5
EPSS Score
0.01
Published
2021-08-24
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
CVSS Score
8.1
EPSS Score
0.029
Published
2021-08-24