Security Vulnerabilities - CVEs Published In 2021
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score
8.3
EPSS Score
0.015
Published
2021-08-10
Due to improper input validation in InfraBox, logs can be modified by an authenticated user.
CVSS Score
4.3
EPSS Score
0.006
Published
2021-08-10
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
CVSS Score
6.1
EPSS Score
0.02
Published
2021-08-10
GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter.
CVSS Score
6.1
EPSS Score
0.009
Published
2021-08-10
In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.
CVSS Score
5.9
EPSS Score
0.016
Published
2021-08-10
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
CVSS Score
7.5
EPSS Score
0.02
Published
2021-08-10
In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS.
CVSS Score
3.7
EPSS Score
0.008
Published
2021-08-10
In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.
CVSS Score
5.3
EPSS Score
0.005
Published
2021-08-10
UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).
CVSS Score
6.1
EPSS Score
0.006
Published
2021-08-10
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).
CVSS Score
9.8
EPSS Score
0.019
Published
2021-08-10