Security Vulnerabilities - CVEs Published In 2021
In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
CVSS Score
6.1
EPSS Score
0.005
Published
2021-08-06
A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.
CVSS Score
5.5
EPSS Score
0.001
Published
2021-08-06
Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed through /gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2]. Among them, the code in [1] is a random string generated according to the user's login related information. It can protect the user's identity, but it can not effectively prevent unauthorized access. The code in [2] is the student number of any student. The attacker can carry out CSRF attack on the system by modifying [2] without modifying [1].
CVSS Score
8.8
EPSS Score
0.006
Published
2021-08-06
A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver and might even gain remote code execution.
CVSS Score
9.8
EPSS Score
0.037
Published
2021-08-06
index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.
CVSS Score
5.4
EPSS Score
0.007
Published
2021-08-06
index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.
CVSS Score
5.4
EPSS Score
0.006
Published
2021-08-06
index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.
CVSS Score
5.4
EPSS Score
0.01
Published
2021-08-06
An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.
CVSS Score
4.3
EPSS Score
0.006
Published
2021-08-06
Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters.
CVSS Score
4.6
EPSS Score
0.006
Published
2021-08-06
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
CVSS Score
5.4
EPSS Score
0.006
Published
2021-08-05